{"uuid": "d7797288-be71-4a4c-9564-674ae008305d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2018-12126", "type": "seen", "source": "https://gist.github.com/fgh130/63d53080ee167c07046112e2e4ca57d8", "content": "Event Time\tEvent ID\tDescription\tLevel\tChannel\tProvider\n05.09.2026 08:28:48.091\t12\tThe operating system started at system time \u200e2026\u200e-\u200e09\u200e-\u200e05T01:28:47.500000000Z.\tInformation\tSystem\tMicrosoft-Windows-Kernel-General\n05.09.2026 08:28:48.091\t25\t\"The system time was initialized to \u200e2026\u200e-\u200e09\u200e-\u200e05T01:28:47.500000000Z. \n\nLoader time: \u200e2026\u200e-\u200e09\u200e-\u200e05T01:28:46.000000000Z\nInternal boot flags: 0x2\nHAL RTC error code: 0x0\nRTC time is in UTC: false\nSoft boot: false\nSuccess: true\nPhase: 0\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-General\n05.09.2026 08:28:48.091\t153\tVirtualization-based security (policies: VBS Enabled,VSM Required,Boot Chain Signer Soft Enforced) is enabled due to HyperV.\tInformation\tSystem\tMicrosoft-Windows-Kernel-Boot\n05.09.2026 08:28:48.091\t82\tTrace point: Function:SipaInsertTcgLog Point:0 Status:STATUS_SUCCESS\tInformation\tMicrosoft-Windows-Kernel-Boot/Operational\tMicrosoft-Windows-Kernel-Boot\n05.09.2026 08:28:48.091\t18\tThere are 0x1 boot options on this system.\tInformation\tSystem\tMicrosoft-Windows-Kernel-Boot\n05.09.2026 08:28:48.091\t32\tThe bootmgr spent 0 ms waiting for user input.\tInformation\tSystem\tMicrosoft-Windows-Kernel-Boot\n05.09.2026 08:28:48.091\t20\tThe last shutdown's success status was true. The last boot's success status was true.\tInformation\tSystem\tMicrosoft-Windows-Kernel-Boot\n05.09.2026 08:28:48.091\t39\tHypervisor Load Options -  IGNOREMEMPART=1 .\tInformation\tMicrosoft-Windows-Hyper-V-Hypervisor-Admin\tMicrosoft-Windows-Hyper-V-Hypervisor\n05.09.2026 08:28:48.091\t156\tHypervisor initial page allocation NUMA policy: Proportional NUMA distribution\tInformation\tMicrosoft-Windows-Hyper-V-Hypervisor-Admin\tMicrosoft-Windows-Hyper-V-Hypervisor\n05.09.2026 08:28:48.091\t238\tEFI time zone bias: 2047. Daylight flags: 0. Firmware time: \u200e2026\u200e-\u200e09\u200e-\u200e05T08:28:46.000000000Z.\tInformation\tSystem\tMicrosoft-Windows-Kernel-Boot\n05.09.2026 08:28:48.091\t85\t\"Read and Unseal Master Key Array Package Status\n\nStatus: STATUS_SUCCESS\nPrimarySealedBlobName: VsmLocalKey2\nSecondaryProtectorVariableName: VsmLocalKeyProtector\nBlobFromUefiVariableSize: 723\nUefiContentIsSealed: 1\nUnsealedBlobSize: 210\nPcr7SealingUsed: 1\nPkgTpmSealMaskLocal: 0x880\nPkgTpmCreationMaskLocal: 0x880\nNeedToResealKeyPkg: 0\nNeedToResealBackup: 0\nNeedToResealPca2023Backup: 0\nPlaintextBlobSize: 210\nPlaintextIsLegacyFormat: 0\nUefiBlobIsCorrupt: 0\nNewKeyID: 0\nVerifiedMicrosoftAuthority: 0\nContainsAuthorityData: 0\nBootmgrAuthorityEventCount: 0\nAuthority: 2\n\nSubstatus\n\nPrimaryBlobUnsealStatus: STATUS_SUCCESS\nBackupBlobUnsealStatus: STATUS_WAIT_1\nPca2023ProtectorUnsealStatus: STATUS_WAIT_1\nBackupBlobValidityCheckStatus: {Object Exists}\nAn attempt was made to create an object and the object name already existed.\nBackupBlobStillValid: true\nPca2023ProtectorValidityCheckStatus: STATUS_WAIT_1\nPca2023ProtectorStillValid: false\nPrimaryBlobResealStatus: STATUS_WAIT_1\nBackupBlobResealStatus: STATUS_WAIT_1\nPca2023ProtectorResealStatus: STATUS_WAIT_1\nV2ProtectorsUsed: 0\nLegacyUefiVarQueryStatus: STATUS_WAIT_1\nLegacyUefiVarCleanupStatus: STATUS_WAIT_1\nActivePolicyVersion: 0\nLatchedPolicyVersion: 0\nUnlatchedPolicyVersion: 0\n\"\tInformation\tMicrosoft-Windows-Kernel-Boot/Operational\tMicrosoft-Windows-Kernel-Boot\n05.09.2026 08:28:48.091\t80\tFASR Platform Verification. FASR cert present: 0. FASR cert signature validation status: 0x1. BootmgrAuthorityEventCount: 0x1. VerifiedMicrosoftAuthority: 1. FASR PCR values validation status: 0x1. PCR mismatch index: -1. FASR cert size: 0. FASR cert: . FASR signature size: 0. FASR signature: .\tInformation\tMicrosoft-Windows-Kernel-Boot/Operational\tMicrosoft-Windows-Kernel-Boot\n05.09.2026 08:28:48.091\t51\tVSM Master Encryption Key Provisioning. Using cached copy status: 0x0. Primary Blob Unseal Status: 0x0. Backup Blob Unseal Status: 0x1. Pca2023 Protector Unseal Status: 0x1. LostOemPk Protector Unseal Status: 0x1. Backup Blob Validity Check Status: 0x40000000. Backup Blob Validity Check Result: true. Pca2023 Protector Validity Check Status: 0x1. Pca2023 Protector Validity Check Result: false. Primary Blob Reseal Status: 0x1. Backup Blob Reseal Status: 0x1. Pca2023 Protector Reseal Status: 0x1. New key generation status: 0x1. Sealing status: 0x1. TPM PCR mask: 0x880. Tpm Counter validation status: 0x2. Tpm Counter creation status: 0x1. Backup sealed blob used: false. Pca2023 Protector cleaned up post upgrade status: 0x1.\tInformation\tMicrosoft-Windows-Kernel-Boot/Operational\tMicrosoft-Windows-Kernel-Boot\n05.09.2026 08:28:48.091\t45\tVSM Identity Key Provisioning. Unsealing cached copy status: 0xC0280018. New key generation status: 0x0. Measuring to PCR status: 0x0. Sealing and caching status: 0x0.\tInformation\tMicrosoft-Windows-Kernel-Boot/Operational\tMicrosoft-Windows-Kernel-Boot\n05.09.2026 08:28:48.091\t25\tThe boot menu policy was 0x1.\tInformation\tSystem\tMicrosoft-Windows-Kernel-Boot\n05.09.2026 08:28:48.091\t27\tThe boot type was 0x0.\tInformation\tSystem\tMicrosoft-Windows-Kernel-Boot\n05.09.2026 08:28:48.099\t1\tHypervisor successfully started.\tInformation\tSystem\tMicrosoft-Windows-Hyper-V-Hypervisor\n05.09.2026 08:28:48.099\t2\tHypervisor scheduler type is 0x4.\tInformation\tSystem\tMicrosoft-Windows-Hyper-V-Hypervisor\n05.09.2026 08:28:48.099\t129\t\"Hypervisor initialized I/O remapping.\n\nHardware present: true\nHardware enabled: true\nPolicy: 0x0\nEnabled features: 0x63\nInternal information: 0x0\nProblems: 0x0\nAdditional information: 0x0\"\tInformation\tSystem\tMicrosoft-Windows-Hyper-V-Hypervisor\n05.09.2026 08:28:48.099\t156\t\"Hypervisor configured mitigations for CVE-2018-3646 for virtual machines.\n\nProcessor not affected: true\nProcessor family not affected: false\nProcessor supports cache flush: true\nHyperThreading enabled: false\nParent hypervisor applies mitigations: false\nMitigations disabled by bcdedit: false\nMitigations enabled: true\nCache flush needed: false\n\"\tInformation\tSystem\tMicrosoft-Windows-Hyper-V-Hypervisor\n05.09.2026 08:28:48.099\t165\t\"Hypervisor configured mitigations for CVE-2019-11091, CVE-2018-12126, CVE-2018-12127, CVE-2018-12130 for virtual machines.\n\nProcessor not affected: true\nProcessor family not affected: false\nProcessor supports microarchitectural buffer flush: true\nBuffer flush needed: false\n\"\tInformation\tSystem\tMicrosoft-Windows-Hyper-V-Hypervisor\n05.09.2026 08:28:48.104\t3\tSecure Kernel started with status STATUS_SUCCESS and flags 82976.\tInformation\tSystem\tMicrosoft-Windows-IsolatedUserMode\n05.09.2026 08:28:48.104\t30\tThe firmware reported boot metrics.\tInformation\tSystem\tMicrosoft-Windows-Kernel-Boot\n05.09.2026 08:28:48.105\t20\t\"The leap second configuration has been updated.\nReason: Leap second data initialized from registry during boot\nLeap seconds enabled: true\nNew leap second count: 0\nOld leap second count: 0\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-General\n05.09.2026 08:28:48.165\t16\tIOMMU fault reporting has been initialized.\tInformation\tSystem\tMicrosoft-Windows-HAL\n05.09.2026 08:28:48.306\t42\tWHEA event log entry\tInformation\tMicrosoft-Windows-Kernel-WHEA/Operational\tMicrosoft-Windows-Kernel-WHEA\n05.09.2026 08:28:48.314\t1\t[ROOT] (Bus 0x0000): Begin state transition from UNINITIALIZED to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:48.315\t1\t[ROOT] (Bus 0x0000): Finish state transition to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:48.317\t42\tWHEA event log entry\tInformation\tMicrosoft-Windows-Kernel-WHEA/Operational\tMicrosoft-Windows-Kernel-WHEA\n05.09.2026 08:28:48.471\t42\tWHEA event log entry\tInformation\tMicrosoft-Windows-Kernel-WHEA/Operational\tMicrosoft-Windows-Kernel-WHEA\n05.09.2026 08:28:48.490\t1\t[PDO] (0x0000.0x00.0x00): Begin state transition from UNINITIALIZED to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:48.490\t1\t[PDO] (0x0000.0x00.0x00): Finish state transition to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:48.490\t1\t[PDO] (0x0000.0x1f.0x00): Begin state transition from UNINITIALIZED to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:48.491\t1\t[PDO] (0x0000.0x1f.0x00): Finish state transition to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:48.499\t1\t[PDO] (0x0000.0x06.0x00): Begin state transition from UNINITIALIZED to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:48.533\t1\t[PDO] (0x0000.0x06.0x00): Finish state transition to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:48.533\t1\t[FDO] (0x0000.0x06.0x00) (Bus 0x0001): Begin state transition from UNINITIALIZED to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:48.534\t1\t[FDO] (0x0000.0x06.0x00) (Bus 0x0001): Finish state transition to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:48.596\t42\tWHEA event log entry\tInformation\tMicrosoft-Windows-Kernel-WHEA/Operational\tMicrosoft-Windows-Kernel-WHEA\n05.09.2026 08:28:48.604\t1\t[PDO] (0x0001.0x00.0x00): Begin state transition from UNINITIALIZED to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:48.631\t1\t[PDO] (0x0001.0x00.0x00): Finish state transition to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:48.632\t576\t\"Storport storage D3 setting.                    \nAdapter Guid: {946c1900-e3df-11f0-b74d-806e6f6e6963}                    \nAdapter port number: 4294967295                    \nAdapter hardware id: PCI\\VEN_1E49&DEV_1081&SUBSYS_10811E49&REV_03                    \nMiniport driver name: stornvme                    \nAdapter interface type: 5                    \nFlags: 4535619747840                    \nStorage D3 allowed: false                    \nACPI DSD property: 1                    \nD3 registry key state: 4294967295                    \nStorage D3 enable: true                    \nDirectFx enable: true\"\tInformation\tMicrosoft-Windows-Storage-Storport/Operational\tMicrosoft-Windows-StorPort\n05.09.2026 08:28:48.671\t527\tThe miniport logged an event.\tWarning\tMicrosoft-Windows-Storage-Storport/Operational\tMicrosoft-Windows-StorPort\n05.09.2026 08:28:48.690\t513\t\"Host Memory Buffer Allocation for \\Device\\RaidPort0 succeeded.                    \nFailure Reason: None                    \nAllocation Policy: Maximum                    \nAttemped to Allocate: \t0x4000000 bytes                    \nActually Allocated: \t0x4000000 bytes                    \nDevice Minimum: \t0x4000000 bytes                    \nDevice Preferred: \t\t0x4000000 bytes                    \nPolicy Maximum: \t\t0x17875000 bytes\"\tInformation\tMicrosoft-Windows-Storage-Storport/Operational\tMicrosoft-Windows-StorPort\n05.09.2026 08:28:48.704\t567\tThe miniport logged an event.\tInformation\tMicrosoft-Windows-Storage-Storport/Operational\tMicrosoft-Windows-StorPort\n05.09.2026 08:28:48.713\t552\tStorport Device (Port = 0, Path = 0, Target = 0, Lun = 0) has arrived.\tInformation\tMicrosoft-Windows-Storage-Storport/Operational\tMicrosoft-Windows-StorPort\n05.09.2026 08:28:48.713\t553\tStorport Device {946c1900-e3df-11f0-b74d-806e6f6e6963} (Port = 0) was rescanned and changes were detected.\tInformation\tMicrosoft-Windows-Storage-Storport/Operational\tMicrosoft-Windows-StorPort\n05.09.2026 08:28:48.715\t6\tFile System Filter 'FileInfo' (10.0, \u200e2093\u200e-\u200e04\u200e-\u200e02T08:29:43.000000000Z) has successfully loaded and registered with Filter Manager.\tInformation\tSystem\tMicrosoft-Windows-FilterManager\n05.09.2026 08:28:48.715\t6\tFile System Filter 'Wof' (10.0, \u200e2047\u200e-\u200e07\u200e-\u200e10T20:40:35.000000000Z) has successfully loaded and registered with Filter Manager.\tInformation\tSystem\tMicrosoft-Windows-FilterManager\n05.09.2026 08:28:48.716\t6\tFile System Filter 'WdFilter' (10.0, \u200e2069\u200e-\u200e10\u200e-\u200e28T18:09:00.000000000Z) has successfully loaded and registered with Filter Manager.\tInformation\tSystem\tMicrosoft-Windows-FilterManager\n05.09.2026 08:28:48.718\t100\tNTFS global corruption action state is now 0.\tInformation\tMicrosoft-Windows-Ntfs/WHC\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:48.755\t1\t[PDO] (0x0000.0x0a.0x00): Begin state transition from UNINITIALIZED to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:48.783\t1\t[PDO] (0x0000.0x0a.0x00): Finish state transition to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:48.785\t104\t\"Enhanced storage device with Class Disk Device Guid: {00000000-0000-0000-0000-000000000000} entered D0 power state.                    \nDevice type: IEEE1667                    \nDevice state: NoSecurity\"\tInformation\tMicrosoft-Windows-EnhancedStorage-EhStorClass/Operational\tMicrosoft-Windows-EnhancedStorage-ClassDriver\n05.09.2026 08:28:48.792\t106\t\"Storage device PDO capabilities discovered on Class Disk Device Guid: {00000000-0000-0000-0000-000000000000}.                    \nDevice PDO Capabilities: INC_512 set\"\tInformation\tMicrosoft-Windows-EnhancedStorage-EhStorClass/Operational\tMicrosoft-Windows-EnhancedStorage-ClassDriver\n05.09.2026 08:28:48.799\t549\t\"This is the first instance of the error seen during this time period                     \non Storport Device (Port = 0, Path = 0, Target = 0, Lun = 0) whose Corresponding Class Disk Device Guid is {00000000-0000-0000-0000-000000000000}:                     \nThe request opcode was 0x1A and completed with SrbStatus 0x6 and ScsiStatus 0x2.                     \nThe sense code was (0x5,0x24,0x0).                     \nThe io latency was 1 ms.\"\tError\tMicrosoft-Windows-Storage-Storport/Operational\tMicrosoft-Windows-StorPort\n05.09.2026 08:28:48.804\t1006\tFor internal use only.\tInformation\tMicrosoft-Windows-Partition/Diagnostic\tMicrosoft-Windows-Partition\n05.09.2026 08:28:48.806\t207\t\"Physical disk {d10f1580-d0d5-c67f-846a-8d6faaba20dc} arrived.                  \nPool Id: {00000000-0000-0000-0000-000000000000}                  \nDrive Number: 0                  \nDrive Manufacturer: NULL                  \nDrive Model Number: YMTC PC41Q-1TB-B                  \nDrive Serial Number: A428_B717_BC98_000A.\"\tInformation\tMicrosoft-Windows-StorageSpaces-Driver/Operational\tMicrosoft-Windows-StorageSpaces-Driver\n05.09.2026 08:28:48.806\t1001\tVolume arrived: volume 1 disk 0 offset 1048576.\tInformation\tMicrosoft-Windows-StorageVolume/Operational\tMicrosoft-Windows-StorageVolume\n05.09.2026 08:28:48.806\t1001\tVolume arrived: volume 2 disk 0 offset 210763776.\tInformation\tMicrosoft-Windows-StorageVolume/Operational\tMicrosoft-Windows-StorageVolume\n05.09.2026 08:28:48.806\t1001\tVolume arrived: volume 3 disk 0 offset 227540992.\tInformation\tMicrosoft-Windows-StorageVolume/Operational\tMicrosoft-Windows-StorageVolume\n05.09.2026 08:28:48.806\t1001\tVolume arrived: volume 4 disk 0 offset 322350088192.\tInformation\tMicrosoft-Windows-StorageVolume/Operational\tMicrosoft-Windows-StorageVolume\n05.09.2026 08:28:48.806\t1001\tVolume arrived: volume 5 disk 0 offset 995218161664.\tInformation\tMicrosoft-Windows-StorageVolume/Operational\tMicrosoft-Windows-StorageVolume\n05.09.2026 08:28:48.806\t1001\tVolume arrived: volume 6 disk 0 offset 996291903488.\tInformation\tMicrosoft-Windows-StorageVolume/Operational\tMicrosoft-Windows-StorageVolume\n05.09.2026 08:28:48.806\t1001\tVolume arrived: volume 7 disk 0 offset 1023135449088.\tInformation\tMicrosoft-Windows-StorageVolume/Operational\tMicrosoft-Windows-StorageVolume\n05.09.2026 08:28:48.811\t100\t\"The volume snapshot driver has begun processing for volume online.\n\nVolume GUID: {23cb36d7-dcac-4575-b04d-8288cc1f8e2a}\n\nGuidance:\nWhen a volume is brought online the volume snapshot driver scans for any persistent snapshots that may be on the volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.813\t101\t\"The volume snapshot driver has completed processing for volume online.\n\nVolume GUID: {23cb36d7-dcac-4575-b04d-8288cc1f8e2a}\n\nGuidance:\nThe volume snapshot driver was able to scan for any persistent snapshots on this volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.813\t100\t\"The volume snapshot driver has begun processing for volume online.\n\nVolume GUID: {4736eb51-c081-4903-81cc-8d311834b73f}\n\nGuidance:\nWhen a volume is brought online the volume snapshot driver scans for any persistent snapshots that may be on the volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.815\t101\t\"The volume snapshot driver has completed processing for volume online.\n\nVolume GUID: {4736eb51-c081-4903-81cc-8d311834b73f}\n\nGuidance:\nThe volume snapshot driver was able to scan for any persistent snapshots on this volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.815\t100\t\"The volume snapshot driver has begun processing for volume online.\n\nVolume GUID: {23606dfe-da07-4ad7-8798-8deaced0a66e}\n\nGuidance:\nWhen a volume is brought online the volume snapshot driver scans for any persistent snapshots that may be on the volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.819\t101\tInitialized VolumeCacheMap for device guid: {23606dfe-da07-4ad7-8798-8deaced0a66e}.\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:28:48.865\t103\t\"Activation of discovered snapshots began.\n\nVolume GUID: {23606dfe-da07-4ad7-8798-8deaced0a66e}\n\nGuidance:\nWhen a volume is brought online or reverted to a snapshot, the volume snapshot driver scans for and activates any persistent snapshots that may be on the volume.\n\nYou should expect this event when a volume is brought online or reverted to a snapshot.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.866\t106\t\"A persistent snapshot was activated.\n\nVolume GUID: {23606dfe-da07-4ad7-8798-8deaced0a66e}\nSnapshot GUID: {51ebadda-a72a-11f1-b7fe-289200f24a99}\nSnapshot Marked Deleted: false\nSnapshot Visible: false\nSnapshot Commit Timestamp: \u200e2026\u200e-\u200e09\u200e-\u200e03T13:17:39.962Z\n\nGuidance:\nWhen a volume is brought online or reverted to a snapshot, the volume snapshot driver scans for and activates any persistent snapshots that may be on the volume.  If the snapshot is 'visible', it was exposed as a local volume or file share.  If the snapshot is 'deleted', it is no longer available for use and its diff area space will be reclaimed when all older snapshots are deleted.\n\nYou should expect this event when a volume containing persistent snapshots is brought online or reverted to a snapshot.  If all discovered snapshots are successfully activated you should expect event 104, otherwise you will see event 105.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.866\t106\t\"A persistent snapshot was activated.\n\nVolume GUID: {23606dfe-da07-4ad7-8798-8deaced0a66e}\nSnapshot GUID: {51ebc0bd-a72a-11f1-b7fe-289200f24a99}\nSnapshot Marked Deleted: false\nSnapshot Visible: false\nSnapshot Commit Timestamp: \u200e2026\u200e-\u200e09\u200e-\u200e03T22:36:10.189Z\n\nGuidance:\nWhen a volume is brought online or reverted to a snapshot, the volume snapshot driver scans for and activates any persistent snapshots that may be on the volume.  If the snapshot is 'visible', it was exposed as a local volume or file share.  If the snapshot is 'deleted', it is no longer available for use and its diff area space will be reclaimed when all older snapshots are deleted.\n\nYou should expect this event when a volume containing persistent snapshots is brought online or reverted to a snapshot.  If all discovered snapshots are successfully activated you should expect event 104, otherwise you will see event 105.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.866\t107\t\"Reading of a snapshot diff area's metadata began.\n\nVolume GUID: {23606dfe-da07-4ad7-8798-8deaced0a66e}\nSnapshot GUID: {5772ff22-a7ee-11f1-b7fe-289200f24a99}\n\nGuidance:\nWhen a volume is brought online or reverted to a snapshot, the volume snapshot driver reads the diff area for the most-recent persistent snapshot (if any).  The diff area for earlier persistent snapshots is typically read the first time the snapshot is read from.\n\nYou should expect this event when a volume is brought online, reverted to a snapshot, or when reading from a persistent snapshot for the first time after bringing a volume online.  This event may also occur if a volume is dismounted that contains snapshots that have not been read since the volume was brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.896\t108\t\"Reading of a snapshot diff area's metadata completed.\n\nVolume GUID: {23606dfe-da07-4ad7-8798-8deaced0a66e}\nSnapshot GUID: {5772ff22-a7ee-11f1-b7fe-289200f24a99}\nCount of 1MB Reads: 4\nCount of 16KB Reads: 2\nDiff Area Metadata Size: 4210688 Bytes\nTotal Data Read: 4227072 Bytes\n\nGuidance:\nWhen a volume is brought online or reverted to a snapshot, the volume snapshot driver reads the diff area for the most-recent persistent snapshot (if any).  The diff area for earlier persistent snapshots is typically read the first time the snapshot is read from.  The size of the diff area metadata may be less than the total number of bytes read if the diff area is discontiguous on disk.\n\nYou should expect this event when a volume is brought online, reverted to a snapshot, or when reading from a persistent snapshot for the first time after bringing a volume online.  This event may also occur if a volume is dismounted that contains snapshots that have not been read since the volume was brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.896\t106\t\"A persistent snapshot was activated.\n\nVolume GUID: {23606dfe-da07-4ad7-8798-8deaced0a66e}\nSnapshot GUID: {5772ff22-a7ee-11f1-b7fe-289200f24a99}\nSnapshot Marked Deleted: false\nSnapshot Visible: false\nSnapshot Commit Timestamp: \u200e2026\u200e-\u200e09\u200e-\u200e04T13:17:42.364Z\n\nGuidance:\nWhen a volume is brought online or reverted to a snapshot, the volume snapshot driver scans for and activates any persistent snapshots that may be on the volume.  If the snapshot is 'visible', it was exposed as a local volume or file share.  If the snapshot is 'deleted', it is no longer available for use and its diff area space will be reclaimed when all older snapshots are deleted.\n\nYou should expect this event when a volume containing persistent snapshots is brought online or reverted to a snapshot.  If all discovered snapshots are successfully activated you should expect event 104, otherwise you will see event 105.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.905\t104\t\"Activation of discovered snapshots completed.\n\nVolume GUID: {23606dfe-da07-4ad7-8798-8deaced0a66e}\nTotal Number of Snapshots Found: 3\nNumber of Snapshots Marked for Delete: 0\nNumber of Visible Snapshots Found: 0\n\nGuidance:\nWhen a volume is brought online or reverted to a snapshot, the volume snapshot driver scans for and activates any persistent snapshots that may be on the volume.  Some snapshots may be marked 'visible', meaning they were exposed as a local volume or file share.  Some detected snapshots may be marked 'deleted', meaning they are no longer available for use and their diff area space will be reclaimed when all older snapshots are deleted.  Look for instances of event 106 to see each snapshot that was discovered and whether it was 'visible' or 'deleted'.\n\nYou should expect this event when a volume is brought online or reverted to a snapshot.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.905\t101\t\"The volume snapshot driver has completed processing for volume online.\n\nVolume GUID: {23606dfe-da07-4ad7-8798-8deaced0a66e}\n\nGuidance:\nThe volume snapshot driver was able to scan for any persistent snapshots on this volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.905\t100\t\"The volume snapshot driver has begun processing for volume online.\n\nVolume GUID: {b4de30fc-d998-46fa-9187-a8f915fd81fc}\n\nGuidance:\nWhen a volume is brought online the volume snapshot driver scans for any persistent snapshots that may be on the volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.908\t101\t\"The volume snapshot driver has completed processing for volume online.\n\nVolume GUID: {b4de30fc-d998-46fa-9187-a8f915fd81fc}\n\nGuidance:\nThe volume snapshot driver was able to scan for any persistent snapshots on this volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.909\t100\t\"The volume snapshot driver has begun processing for volume online.\n\nVolume GUID: {071ed15c-a672-4f3b-b36f-218dce297808}\n\nGuidance:\nWhen a volume is brought online the volume snapshot driver scans for any persistent snapshots that may be on the volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.911\t101\t\"The volume snapshot driver has completed processing for volume online.\n\nVolume GUID: {071ed15c-a672-4f3b-b36f-218dce297808}\n\nGuidance:\nThe volume snapshot driver was able to scan for any persistent snapshots on this volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.911\t100\t\"The volume snapshot driver has begun processing for volume online.\n\nVolume GUID: {f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n\nGuidance:\nWhen a volume is brought online the volume snapshot driver scans for any persistent snapshots that may be on the volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.915\t101\t\"The volume snapshot driver has completed processing for volume online.\n\nVolume GUID: {f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n\nGuidance:\nThe volume snapshot driver was able to scan for any persistent snapshots on this volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.916\t100\t\"The volume snapshot driver has begun processing for volume online.\n\nVolume GUID: {580f6681-a25f-4cec-9096-3d65cabf1f4a}\n\nGuidance:\nWhen a volume is brought online the volume snapshot driver scans for any persistent snapshots that may be on the volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.917\t101\t\"The volume snapshot driver has completed processing for volume online.\n\nVolume GUID: {580f6681-a25f-4cec-9096-3d65cabf1f4a}\n\nGuidance:\nThe volume snapshot driver was able to scan for any persistent snapshots on this volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:49.191\t4\t\"The NTFS volume has been successfully mounted.\n\n           Volume correlation Id: {23606dfe-da07-4ad7-8798-8deaced0a66e}\n           Volume name: C:\n           Volume label: Windows\n\n           Device name: \\Device\\HarddiskVolume3\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Device number: 0\n           Boot partition: true\n\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n           \n           Total mount duration: 374 ms\n           Longest stage: 8. Duration 212 ms (57% of the total)\n           Second longest stage: 4. Duration 86 ms (23% of the total)\n           Volume restart applied: false\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:49.191\t9\t\"NTFS scanned entire volume bitmap.\n\n           Volume correlation Id: {23606dfe-da07-4ad7-8798-8deaced0a66e}\n           Volume name: C:\n           Volume label: Windows\n\n           Device name: \\Device\\HarddiskVolume3\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n\n           Duration (micro seconds): 28359\n           InputFlags: 0xE\n           Reason: Mount\n           Flags: 0x10\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:49.191\t98\tVolume C: (\\Device\\HarddiskVolume3) is healthy.  No action is needed.\tInformation\tSystem\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:49.191\t10\t\"NTFS cached runs statistics.\n\n           Volume correlation Id: {23606dfe-da07-4ad7-8798-8deaced0a66e}\n           Volume name: C:\n           Volume label: Windows\n\n           Device name: \\Device\\HarddiskVolume3\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n\n           Media type: Hard disk\n           Runs cached: 3171\n           Longest run cached: 73.38 GB\n           Most populated bin Count: 71\n           Most populated bin's minimum length: 7.51 MB\n           Most populated bin's maximum length: 7.75 MB\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:49.192\t101\tInitialized VolumeCacheMap for device guid: {00000000-0000-0000-0000-000000000000}.\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:28:49.263\t3084\tCode Integrity will enable WHQL driver enforcement for this boot session.  Settings 0x0. Exemption 1.\tInformation\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:28:49.264\t3099\tRefreshed and activated Code Integrity policy {60fd87f8-4593-44a0-91b0-2e0da022f248} Microsoft Windows Endpoint Security Policy. id 10.0.29526.0. Status 0x0\tInformation\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:28:49.264\t3116\tSignature information for Code Integrity policy ID {60fd87f8-4593-44a0-91b0-2e0da022f248}.\tInformation\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:28:49.264\t3099\tRefreshed and activated Code Integrity policy {784c4414-79f4-4c32-a6a5-f0fb42a51d0d} Microsoft Windows Cross Certificates for Code Integrity Exceptions Audit Policy. id 10.29611.0.0. Status 0x0\tInformation\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:28:49.264\t3116\tSignature information for Code Integrity policy ID {784c4414-79f4-4c32-a6a5-f0fb42a51d0d}.\tInformation\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:28:49.264\t3099\tRefreshed and activated Code Integrity policy {8f9cb695-5d48-48d6-a329-7202b44607e3} Microsoft Windows Cross Certificates for Code Integrity Exceptions Policy. id 10.29611.0.0. Status 0x0\tInformation\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:28:49.264\t3116\tSignature information for Code Integrity policy ID {8f9cb695-5d48-48d6-a329-7202b44607e3}.\tInformation\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:28:49.264\t3099\tRefreshed and activated Code Integrity policy {a072029f-588b-4b5e-b7f9-05aad67df687} Microsoft Windows Virtualization Based Security Policy. id 10.0.29644.0. Status 0x0\tInformation\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:28:49.265\t3116\tSignature information for Code Integrity policy ID {a072029f-588b-4b5e-b7f9-05aad67df687}.\tInformation\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:28:49.274\t101\tInitialized VolumeCacheMap for device guid: {00000000-0000-0000-0000-000000000000}.\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:28:49.289\t42\tWHEA event log entry\tInformation\tMicrosoft-Windows-Kernel-WHEA/Operational\tMicrosoft-Windows-Kernel-WHEA\n05.09.2026 08:28:49.289\t42\tWHEA event log entry\tInformation\tMicrosoft-Windows-Kernel-WHEA/Operational\tMicrosoft-Windows-Kernel-WHEA\n05.09.2026 08:28:49.295\t5\t\"WHEA successfully initialized.\n   6 error sources are active\n   Error record format version is 10.\"\tInformation\tMicrosoft-Windows-Kernel-WHEA/Operational\tMicrosoft-Windows-Kernel-WHEA\n05.09.2026 08:28:49.295\t42\tWHEA event log entry\tInformation\tMicrosoft-Windows-Kernel-WHEA/Operational\tMicrosoft-Windows-Kernel-WHEA\n05.09.2026 08:28:49.306\t6\tFile System Filter 'FileCrypt' (10.0, \u200e2075\u200e-\u200e09\u200e-\u200e01T05:07:07.000000000Z) has successfully loaded and registered with Filter Manager.\tInformation\tSystem\tMicrosoft-Windows-FilterManager\n05.09.2026 08:28:49.313\t9\t\"NTFS scanned entire volume bitmap.\n\n           Volume correlation Id: {5772ff22-a7ee-11f1-b7fe-289200f24a99}\n           Volume name: \n           Volume label: Windows\n\n           Device name: \\Device\\HarddiskVolumeShadowCopy3\n           Device GUID: {00000000-0000-0000-0000-000000000000}\n           Device manufacturer: \n           Device model: \n           Device revision: \n           Device serial number: \n           Bus type: \n           Native NVMe: false\n\n           Adapter serial number: \n\n           Duration (micro seconds): 32610\n           InputFlags: 0xE\n           Reason: Mount\n           Flags: 0x10\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:49.313\t10\t\"NTFS cached runs statistics.\n\n           Volume correlation Id: {5772ff22-a7ee-11f1-b7fe-289200f24a99}\n           Volume name: \n           Volume label: Windows\n\n           Device name: \\Device\\HarddiskVolumeShadowCopy3\n           Device GUID: {00000000-0000-0000-0000-000000000000}\n           Device manufacturer: \n           Device model: \n           Device revision: \n           Device serial number: \n           Bus type: \n           Native NVMe: false\n\n           Adapter serial number: \n\n           Media type: Hard disk\n           Runs cached: 6049\n           Longest run cached: 73.38 GB\n           Most populated bin Count: 72\n           Most populated bin's minimum length: 7.51 MB\n           Most populated bin's maximum length: 7.75 MB\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:49.313\t4\t\"The NTFS volume has been successfully mounted.\n\n           Volume correlation Id: {5772ff22-a7ee-11f1-b7fe-289200f24a99}\n           Volume name: Windows\n           Volume label: Windows\n\n           Device name: \\Device\\HarddiskVolumeShadowCopy3\n           Device GUID: {00000000-0000-0000-0000-000000000000}\n           Device manufacturer: \n           Device model: \n           Device revision: \n           Device serial number: \n           Bus type: \n           Device number: 4294967295\n           Boot partition: false\n\n           Native NVMe: false\n\n           Adapter serial number: \n           \n           Total mount duration: 39 ms\n           Longest stage: 7. Duration 35 ms (90% of the total)\n           Second longest stage: 8. Duration 2 ms (5% of the total)\n           Volume restart applied: false\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:49.360\t6\tFile System Filter 'QesEngEx' (10.0, \u200e2025\u200e-\u200e10\u200e-\u200e23T14:48:14.000000000Z) has successfully loaded and registered with Filter Manager.\tInformation\tSystem\tMicrosoft-Windows-FilterManager\n05.09.2026 08:28:49.364\t6\tFile System Filter 'UCPD' (10.0, \u200e2104\u200e-\u200e11\u200e-\u200e25T06:34:34.000000000Z) has successfully loaded and registered with Filter Manager.\tInformation\tSystem\tMicrosoft-Windows-FilterManager\n05.09.2026 08:28:49.436\t7036\tThe  service entered the Driver load complete state.\tInformation\tSystem\tVfpExt\n05.09.2026 08:28:49.436\t7036\tThe  service entered the Driver load start state.\tInformation\tSystem\tVfpExt\n05.09.2026 08:28:49.460\t6\tFile System Filter 'npsvctrig' (10.0, \u200e1978\u200e-\u200e05\u200e-\u200e14T16:13:30.000000000Z) has successfully loaded and registered with Filter Manager.\tInformation\tSystem\tMicrosoft-Windows-FilterManager\n05.09.2026 08:28:49.486\t125\t\"ACPI thermal zone \\_TZ.TZ00 has been enumerated.             \n_PSV = 0K             \n_TC1 = 0             \n_TC2 = 0             \n_TSP = 0ms             \n_AC0 = 366K             \n_AC1 = 328K             \n_AC2 = 323K             \n_AC3 = 318K             \n_AC4 = 313K             \n_AC5 = 0K             \n_AC6 = 0K             \n_AC7 = 0K             \n_AC8 = 0K             \n_AC9 = 0K             \n_CRT = 388K             \n_HOT = 368K             \nminimum throttle = 0             \n_CR3 = 0K\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Power\n05.09.2026 08:28:49.493\t4688\t\"A new process has been created.\n\nCreator Subject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x3E7\n\nTarget Subject:\n\tSecurity ID:\t\tS-1-0-0\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x0\n\nProcess Information:\n\tNew Process ID:\t\t0x104\n\tNew Process Name:\t\n\tToken Elevation Type:\tTokenElevationTypeDefault (1)\n\tMandatory Label:\t\tS-1-16-16384\n\tCreator Process ID:\t0x4\n\tCreator Process Name:\t\n\tProcess Command Line:\t\n\nToken Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.\n\nType 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.\n\nType 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.\n\nType 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:49.493\t4688\t\"A new process has been created.\n\nCreator Subject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x3E7\n\nTarget Subject:\n\tSecurity ID:\t\tS-1-0-0\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x0\n\nProcess Information:\n\tNew Process ID:\t\t0x130\n\tNew Process Name:\tRegistry\n\tToken Elevation Type:\tTokenElevationTypeDefault (1)\n\tMandatory Label:\t\tS-1-16-16384\n\tCreator Process ID:\t0x4\n\tCreator Process Name:\t\n\tProcess Command Line:\t\n\nToken Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.\n\nType 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.\n\nType 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.\n\nType 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:49.493\t4696\t\"A primary token was assigned to process.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x3E7\n\nProcess Information:\n\tProcess ID:\t0x4\n\tProcess Name:\t\n\nTarget Process:\n\tTarget Process ID:\t0x130\n\tTarget Process Name:\tRegistry\n\nNew Token Information:\n\tSecurity ID:\t\tS-1-0-0\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x3E7\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:49.493\t4826\t\"Boot Configuration Data loaded.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x3E7\n\nGeneral Settings:\n\tLoad Options:\t\t-\n\tAdvanced Options:\t\tNo\n\tConfiguration Access Policy:\tDefault\n\tSystem Event Logging:\tNo\n\tKernel Debugging:\tNo\n\tVSM Launch Type:\tAuto\n\nSignature Settings:\n\tTest Signing:\t\tNo\n\tFlight Signing:\t\tNo\n\tDisable Integrity Checks:\tNo\n\nHyperVisor Settings:\n\tHyperVisor Load Options:\t-\n\tHyperVisor Launch Type:\tAuto\n\tHyperVisor Debugging:\tNo\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:49.495\t10118\tUMDF reflector is unable to connect to service control manager (SCM). This is expected during boot, when SCM has not started yet. Will retry when it starts.\tInformation\tSystem\tMicrosoft-Windows-DriverFrameworks-UserMode\n05.09.2026 08:28:49.496\t219\t\"The driver \\Driver\\WUDFRd failed to load.\nDevice: ROOT\\VIRTUAL_HID\\0000\nStatus: 0xC0000365\"\tWarning\tSystem\tMicrosoft-Windows-Kernel-PnP\n05.09.2026 08:28:49.499\t4688\t\"A new process has been created.\n\nCreator Subject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x3E7\n\nTarget Subject:\n\tSecurity ID:\t\tS-1-0-0\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x0\n\nProcess Information:\n\tNew Process ID:\t\t0x3d0\n\tNew Process Name:\tC:\\Windows\\System32\\smss.exe\n\tToken Elevation Type:\tTokenElevationTypeDefault (1)\n\tMandatory Label:\t\tS-1-16-16384\n\tCreator Process ID:\t0x4\n\tCreator Process Name:\t\n\tProcess Command Line:\t\n\nToken Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.\n\nType 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.\n\nType 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.\n\nType 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:49.976\t10118\tUMDF reflector is unable to connect to service control manager (SCM). This is expected during boot, when SCM has not started yet. Will retry when it starts.\tInformation\tSystem\tMicrosoft-Windows-DriverFrameworks-UserMode\n05.09.2026 08:28:49.977\t219\t\"The driver \\Driver\\WUDFRd failed to load.\nDevice: PCI\\VEN_8086&DEV_7D03&SUBSYS_21051EE7&REV_04\\3&11583659&0&20\nStatus: 0xC0000365\"\tWarning\tSystem\tMicrosoft-Windows-Kernel-PnP\n05.09.2026 08:28:50.038\t4\t\"Flags [1126312223703044] were applied to device [USBXHCI:ALL] - class [USBXHCI].\n\nFlags source: applied through compatibility database.\"\tInformation\tMicrosoft-Windows-Kernel-ShimEngine/Operational\tMicrosoft-Windows-Kernel-ShimEngine\n05.09.2026 08:28:50.038\t4\t\"Flags [7206885442550497440] were applied to device [USBXHCI:PCI\\VEN_8086] - class [USBXHCI].\n\nFlags source: applied through compatibility database.\"\tInformation\tMicrosoft-Windows-Kernel-ShimEngine/Operational\tMicrosoft-Windows-Kernel-ShimEngine\n05.09.2026 08:28:50.042\t4\t\"Flags [2181300322] were applied to device [USBXHCI:PCI\\VEN_8086] - class [USBXHCI2].\n\nFlags source: applied through compatibility database.\"\tInformation\tMicrosoft-Windows-Kernel-ShimEngine/Operational\tMicrosoft-Windows-Kernel-ShimEngine\n05.09.2026 08:28:50.042\t4\t\"Flags [5242880] were applied to device [USBXHCI:PCI\\VEN_8086&DEV_7EC0] - class [USBXHCI2].\n\nFlags source: applied through compatibility database.\"\tInformation\tMicrosoft-Windows-Kernel-ShimEngine/Operational\tMicrosoft-Windows-Kernel-ShimEngine\n05.09.2026 08:28:50.047\t4\t\"Flags [1126312223703044] were applied to device [USBXHCI:ALL] - class [USBXHCI].\n\nFlags source: applied through compatibility database.\"\tInformation\tMicrosoft-Windows-Kernel-ShimEngine/Operational\tMicrosoft-Windows-Kernel-ShimEngine\n05.09.2026 08:28:50.047\t4\t\"Flags [7206885442550497440] were applied to device [USBXHCI:PCI\\VEN_8086] - class [USBXHCI].\n\nFlags source: applied through compatibility database.\"\tInformation\tMicrosoft-Windows-Kernel-ShimEngine/Operational\tMicrosoft-Windows-Kernel-ShimEngine\n05.09.2026 08:28:50.048\t4688\t\"A new process has been created.\n\nCreator Subject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x3E7\n\nTarget Subject:\n\tSecurity ID:\t\tS-1-0-0\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x0\n\nProcess Information:\n\tNew Process ID:\t\t0x3f4\n\tNew Process Name:\tC:\\Windows\\System32\\autochk.exe\n\tToken Elevation Type:\tTokenElevationTypeDefault (1)\n\tMandatory Label:\t\tS-1-16-16384\n\tCreator Process ID:\t0x3d0\n\tCreator Process Name:\tC:\\Windows\\System32\\smss.exe\n\tProcess Command Line:\t\n\nToken Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.\n\nType 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.\n\nType 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.\n\nType 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:50.050\t4\t\"Flags [2181300322] were applied to device [USBXHCI:PCI\\VEN_8086] - class [USBXHCI2].\n\nFlags source: applied through compatibility database.\"\tInformation\tMicrosoft-Windows-Kernel-ShimEngine/Operational\tMicrosoft-Windows-Kernel-ShimEngine\n05.09.2026 08:28:50.050\t4\t\"Flags [1048576] were applied to device [USBXHCI:PCI\\VEN_8086&DEV_7E7D] - class [USBXHCI2].\n\nFlags source: applied through compatibility database.\"\tInformation\tMicrosoft-Windows-Kernel-ShimEngine/Operational\tMicrosoft-Windows-Kernel-ShimEngine\n05.09.2026 08:28:50.079\t101\tInitialized VolumeCacheMap for device guid: {23cb36d7-dcac-4575-b04d-8288cc1f8e2a}.\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:28:50.118\t42\tWHEA event log entry\tInformation\tMicrosoft-Windows-Kernel-WHEA/Operational\tMicrosoft-Windows-Kernel-WHEA\n05.09.2026 08:28:50.126\t1\t\tInformation\tSystem\tWDTDrv\n05.09.2026 08:28:50.205\t155\t\"Host processor features mask: \n\nHost xsave features mask: 0x4058381F\n\nHost cache line flush size: 64 bytes\"\tInformation\tMicrosoft-Windows-Hyper-V-Hypervisor-Admin\tMicrosoft-Windows-Hyper-V-Hypervisor\n05.09.2026 08:28:50.208\t1\t[PDO] (0x0000.0x02.0x00): Begin state transition from UNINITIALIZED to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.236\t1\t[PDO] (0x0000.0x02.0x00): Finish state transition to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.237\t1\t[PDO] (0x0000.0x08.0x00): Begin state transition from UNINITIALIZED to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.237\t1\t[PDO] (0x0000.0x0b.0x00): Begin state transition from UNINITIALIZED to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.244\t101\tInitialized VolumeCacheMap for device guid: {b4de30fc-d998-46fa-9187-a8f915fd81fc}.\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:28:50.267\t1\t[PDO] (0x0000.0x08.0x00): Finish state transition to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.267\t1\t[PDO] (0x0000.0x0b.0x00): Finish state transition to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.269\t1\t[PDO] (0x0000.0x14.0x00): Begin state transition from UNINITIALIZED to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.269\t1\t[PDO] (0x0000.0x14.0x03): Begin state transition from UNINITIALIZED to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.269\t1\t[PDO] (0x0000.0x0d.0x00): Begin state transition from UNINITIALIZED to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.299\t1\t[PDO] (0x0000.0x0d.0x00): Finish state transition to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.299\t1\t[PDO] (0x0000.0x14.0x00): Finish state transition to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.299\t1\t[PDO] (0x0000.0x14.0x03): Finish state transition to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.299\t1\t[PDO] (0x0000.0x16.0x00): Begin state transition from UNINITIALIZED to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.300\t7036\tThe \\Device\\NDMP2 service entered the Intel(R) Wi-Fi 6 AX201 160MHz state.\tInformation\tSystem\tNetwtw14\n05.09.2026 08:28:50.304\t7029\t7029 - Wi-Fi Driver Initialization\tInformation\tSystem\tNetwtw14\n05.09.2026 08:28:50.306\t55\t\"Processor 2 in group 0 exposes the following power management capabilities:\n\nIdle state type: Micro Power Engine Plugin (11 state(s))\n\nPerformance state type: ACPI Collaborative Processor Performance Control\nNominal Frequency (MHz): 3600\nMaximum performance percentage: 100\nMinimum performance percentage: 27\nMinimum throttle percentage: 2\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:28:50.308\t55\t\"Processor 3 in group 0 exposes the following power management capabilities:\n\nIdle state type: Micro Power Engine Plugin (11 state(s))\n\nPerformance state type: ACPI Collaborative Processor Performance Control\nNominal Frequency (MHz): 3600\nMaximum performance percentage: 100\nMinimum performance percentage: 27\nMinimum throttle percentage: 2\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:28:50.311\t55\t\"Processor 4 in group 0 exposes the following power management capabilities:\n\nIdle state type: Micro Power Engine Plugin (11 state(s))\n\nPerformance state type: ACPI Collaborative Processor Performance Control\nNominal Frequency (MHz): 3600\nMaximum performance percentage: 100\nMinimum performance percentage: 27\nMinimum throttle percentage: 2\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:28:50.313\t9\t\"NTFS scanned entire volume bitmap.\n\n           Volume correlation Id: {b4de30fc-d998-46fa-9187-a8f915fd81fc}\n           Volume name: D:\n           Volume label: Data\n\n           Device name: \\Device\\HarddiskVolume4\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n\n           Duration (micro seconds): 59915\n           InputFlags: 0xE\n           Reason: Mount\n           Flags: 0x10\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:50.313\t10\t\"NTFS cached runs statistics.\n\n           Volume correlation Id: {b4de30fc-d998-46fa-9187-a8f915fd81fc}\n           Volume name: D:\n           Volume label: Data\n\n           Device name: \\Device\\HarddiskVolume4\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n\n           Media type: Hard disk\n           Runs cached: 11\n           Longest run cached: 607.51 GB\n           Most populated bin Count: 3\n           Most populated bin's minimum length: 992.01 MB\n           Most populated bin's maximum length: -\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:50.313\t4\t\"The NTFS volume has been successfully mounted.\n\n           Volume correlation Id: {b4de30fc-d998-46fa-9187-a8f915fd81fc}\n           Volume name: D:\n           Volume label: Data\n\n           Device name: \\Device\\HarddiskVolume4\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Device number: 0\n           Boot partition: false\n\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n           \n           Total mount duration: 71 ms\n           Longest stage: 7. Duration 61 ms (86% of the total)\n           Second longest stage: 5. Duration 4 ms (6% of the total)\n           Volume restart applied: false\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:50.313\t98\tVolume D: (\\Device\\HarddiskVolume4) is healthy.  No action is needed.\tInformation\tSystem\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:50.314\t55\t\"Processor 5 in group 0 exposes the following power management capabilities:\n\nIdle state type: Micro Power Engine Plugin (11 state(s))\n\nPerformance state type: ACPI Collaborative Processor Performance Control\nNominal Frequency (MHz): 3600\nMaximum performance percentage: 100\nMinimum performance percentage: 27\nMinimum throttle percentage: 2\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:28:50.314\t7027\t7027 - Wi-Fi Driver Info\tInformation\tSystem\tNetwtw14\n05.09.2026 08:28:50.316\t55\t\"Processor 6 in group 0 exposes the following power management capabilities:\n\nIdle state type: Micro Power Engine Plugin (11 state(s))\n\nPerformance state type: ACPI Collaborative Processor Performance Control\nNominal Frequency (MHz): 3600\nMaximum performance percentage: 100\nMinimum performance percentage: 27\nMinimum throttle percentage: 2\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:28:50.318\t55\t\"Processor 7 in group 0 exposes the following power management capabilities:\n\nIdle state type: Micro Power Engine Plugin (11 state(s))\n\nPerformance state type: ACPI Collaborative Processor Performance Control\nNominal Frequency (MHz): 3600\nMaximum performance percentage: 100\nMinimum performance percentage: 27\nMinimum throttle percentage: 2\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:28:50.320\t55\t\"Processor 8 in group 0 exposes the following power management capabilities:\n\nIdle state type: Micro Power Engine Plugin (11 state(s))\n\nPerformance state type: ACPI Collaborative Processor Performance Control\nNominal Frequency (MHz): 3600\nMaximum performance percentage: 100\nMinimum performance percentage: 27\nMinimum throttle percentage: 2\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:28:50.323\t55\t\"Processor 9 in group 0 exposes the following power management capabilities:\n\nIdle state type: Micro Power Engine Plugin (11 state(s))\n\nPerformance state type: ACPI Collaborative Processor Performance Control\nNominal Frequency (MHz): 3600\nMaximum performance percentage: 100\nMinimum performance percentage: 27\nMinimum throttle percentage: 2\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:28:50.325\t55\t\"Processor 10 in group 0 exposes the following power management capabilities:\n\nIdle state type: Micro Power Engine Plugin (11 state(s))\n\nPerformance state type: ACPI Collaborative Processor Performance Control\nNominal Frequency (MHz): 1200\nMaximum performance percentage: 380\nMinimum performance percentage: 100\nMinimum throttle percentage: 6\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:28:50.328\t101\tInitialized VolumeCacheMap for device guid: {071ed15c-a672-4f3b-b36f-218dce297808}.\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:28:50.330\t1\t[PDO] (0x0000.0x16.0x00): Finish state transition to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.332\t2\tIntel(R) Management Engine Interface driver has started successfully.\tInformation\tSystem\tMEIx64\n05.09.2026 08:28:50.339\t55\t\"Processor 11 in group 0 exposes the following power management capabilities:\n\nIdle state type: Micro Power Engine Plugin (11 state(s))\n\nPerformance state type: ACPI Collaborative Processor Performance Control\nNominal Frequency (MHz): 1200\nMaximum performance percentage: 380\nMinimum performance percentage: 100\nMinimum throttle percentage: 6\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:28:50.353\t55\t\"Processor 12 in group 0 exposes the following power management capabilities:\n\nIdle state type: Micro Power Engine Plugin (11 state(s))\n\nPerformance state type: ACPI Collaborative Processor Performance Control\nNominal Frequency (MHz): 1200\nMaximum performance percentage: 380\nMinimum performance percentage: 100\nMinimum throttle percentage: 6\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:28:50.353\t101\tInitialized VolumeCacheMap for device guid: {580f6681-a25f-4cec-9096-3d65cabf1f4a}.\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:28:50.355\t55\t\"Processor 13 in group 0 exposes the following power management capabilities:\n\nIdle state type: Micro Power Engine Plugin (11 state(s))\n\nPerformance state type: ACPI Collaborative Processor Performance Control\nNominal Frequency (MHz): 1200\nMaximum performance percentage: 380\nMinimum performance percentage: 100\nMinimum throttle percentage: 6\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:28:50.359\t9\t\"NTFS scanned entire volume bitmap.\n\n           Volume correlation Id: {580f6681-a25f-4cec-9096-3d65cabf1f4a}\n           Volume name: \\\\?\\Volume{580f6681-a25f-4cec-9096-3d65cabf1f4a}\n           Volume label: WinRE\n\n           Device name: \\Device\\HarddiskVolume7\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n\n           Duration (micro seconds): 160\n           InputFlags: 0xE\n           Reason: Mount\n           Flags: 0x10\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:50.359\t10\t\"NTFS cached runs statistics.\n\n           Volume correlation Id: {580f6681-a25f-4cec-9096-3d65cabf1f4a}\n           Volume name: \\\\?\\Volume{580f6681-a25f-4cec-9096-3d65cabf1f4a}\n           Volume label: WinRE\n\n           Device name: \\Device\\HarddiskVolume7\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n\n           Media type: Hard disk\n           Runs cached: 1\n           Longest run cached: 30.55 MB\n           Most populated bin Count: 1\n           Most populated bin's minimum length: 30.01 MB\n           Most populated bin's maximum length: 31 MB\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:50.359\t4\t\"The NTFS volume has been successfully mounted.\n\n           Volume correlation Id: {580f6681-a25f-4cec-9096-3d65cabf1f4a}\n           Volume name: \\\\?\\Volume{580f6681-a25f-4cec-9096-3d65cabf1f4a}\n           Volume label: WinRE\n\n           Device name: \\Device\\HarddiskVolume7\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Device number: 0\n           Boot partition: false\n\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n           \n           Total mount duration: 8 ms\n           Longest stage: 2. Duration 2 ms (25% of the total)\n           Second longest stage: 1. Duration 2 ms (25% of the total)\n           Volume restart applied: false\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:50.359\t98\tVolume \\\\?\\Volume{580f6681-a25f-4cec-9096-3d65cabf1f4a} (\\Device\\HarddiskVolume7) is healthy.  No action is needed.\tInformation\tSystem\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:50.376\t101\tInitialized VolumeCacheMap for device guid: {f7c299ce-44f9-435a-a486-3d3fb2bfc802}.\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:28:50.383\t4\t\"The NTFS volume has been successfully mounted.\n\n           Volume correlation Id: {f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n           Volume name: \\\\?\\Volume{f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n           Volume label: Onekey\n\n           Device name: \\Device\\HarddiskVolume6\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Device number: 0\n           Boot partition: false\n\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n           \n           Total mount duration: 9 ms\n           Longest stage: 5. Duration 2 ms (21% of the total)\n           Second longest stage: 1. Duration 2 ms (21% of the total)\n           Volume restart applied: false\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:50.383\t9\t\"NTFS scanned entire volume bitmap.\n\n           Volume correlation Id: {f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n           Volume name: \\\\?\\Volume{f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n           Volume label: Onekey\n\n           Device name: \\Device\\HarddiskVolume6\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n\n           Duration (micro seconds): 2268\n           InputFlags: 0xE\n           Reason: Mount\n           Flags: 0x10\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:50.383\t98\tVolume \\\\?\\Volume{f7c299ce-44f9-435a-a486-3d3fb2bfc802} (\\Device\\HarddiskVolume6) is healthy.  No action is needed.\tInformation\tSystem\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:50.383\t10\t\"NTFS cached runs statistics.\n\n           Volume correlation Id: {f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n           Volume name: \\\\?\\Volume{f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n           Volume label: Onekey\n\n           Device name: \\Device\\HarddiskVolume6\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n\n           Media type: Hard disk\n           Runs cached: 1\n           Longest run cached: 9.04 GB\n           Most populated bin Count: 1\n           Most populated bin's minimum length: 992.01 MB\n           Most populated bin's maximum length: -\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:50.414\t55\t\"Processor 0 in group 0 exposes the following power management capabilities:\n\nIdle state type: Micro Power Engine Plugin (11 state(s))\n\nPerformance state type: ACPI Collaborative Processor Performance Control\nNominal Frequency (MHz): 1200\nMaximum performance percentage: 380\nMinimum performance percentage: 100\nMinimum throttle percentage: 6\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:28:50.416\t55\t\"Processor 1 in group 0 exposes the following power management capabilities:\n\nIdle state type: Micro Power Engine Plugin (11 state(s))\n\nPerformance state type: ACPI Collaborative Processor Performance Control\nNominal Frequency (MHz): 1200\nMaximum performance percentage: 380\nMinimum performance percentage: 100\nMinimum throttle percentage: 6\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:28:50.419\t24\tThe time zone information was refreshed with exit reason 0. Current time zone bias is -420.\tInformation\tSystem\tMicrosoft-Windows-Kernel-General\n05.09.2026 08:28:50.430\t55\t\"Processor 14 in group 0 exposes the following power management capabilities:\n\nIdle state type: Micro Power Engine Plugin (11 state(s))\n\nPerformance state type: ACPI Collaborative Processor Performance Control\nNominal Frequency (MHz): 1200\nMaximum performance percentage: 380\nMinimum performance percentage: 100\nMinimum throttle percentage: 6\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:28:50.432\t55\t\"Processor 15 in group 0 exposes the following power management capabilities:\n\nIdle state type: Micro Power Engine Plugin (11 state(s))\n\nPerformance state type: ACPI Collaborative Processor Performance Control\nNominal Frequency (MHz): 1200\nMaximum performance percentage: 380\nMinimum performance percentage: 100\nMinimum throttle percentage: 6\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:28:50.435\t55\t\"Processor 16 in group 0 exposes the following power management capabilities:\n\nIdle state type: Micro Power Engine Plugin (11 state(s))\n\nPerformance state type: ACPI Collaborative Processor Performance Control\nNominal Frequency (MHz): 2500\nMaximum performance percentage: 100\nMinimum performance percentage: 44\nMinimum throttle percentage: 4\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:28:50.506\t4\t\"Flags [1126312223703044] were applied to device [USBXHCI:ALL] - class [USBXHCI].\n\nFlags source: applied through compatibility database.\"\tInformation\tMicrosoft-Windows-Kernel-ShimEngine/Operational\tMicrosoft-Windows-Kernel-ShimEngine\n05.09.2026 08:28:50.506\t4\t\"Flags [1126312223703044] were applied to device [USBXHCI:ALL] - class [USBXHCI].\n\nFlags source: applied through compatibility database.\"\tInformation\tMicrosoft-Windows-Kernel-ShimEngine/Operational\tMicrosoft-Windows-Kernel-ShimEngine\n05.09.2026 08:28:50.506\t4\t\"Flags [7206885442550497440] were applied to device [USBXHCI:PCI\\VEN_8086] - class [USBXHCI].\n\nFlags source: applied through compatibility database.\"\tInformation\tMicrosoft-Windows-Kernel-ShimEngine/Operational\tMicrosoft-Windows-Kernel-ShimEngine\n05.09.2026 08:28:50.506\t4\t\"Flags [7206885442550497440] were applied to device [USBXHCI:PCI\\VEN_8086] - class [USBXHCI].\n\nFlags source: applied through compatibility database.\"\tInformation\tMicrosoft-Windows-Kernel-ShimEngine/Operational\tMicrosoft-Windows-Kernel-ShimEngine\n05.09.2026 08:28:50.510\t4\t\"Flags [2181300322] were applied to device [USBXHCI:PCI\\VEN_8086] - class [USBXHCI2].\n\nFlags source: applied through compatibility database.\"\tInformation\tMicrosoft-Windows-Kernel-ShimEngine/Operational\tMicrosoft-Windows-Kernel-ShimEngine\n05.09.2026 08:28:50.510\t4\t\"Flags [1048576] were applied to device [USBXHCI:PCI\\VEN_8086&DEV_7E7D] - class [USBXHCI2].\n\nFlags source: applied through compatibility database.\"\tInformation\tMicrosoft-Windows-Kernel-ShimEngine/Operational\tMicrosoft-Windows-Kernel-ShimEngine\n05.09.2026 08:28:50.510\t4\t\"Flags [2181300322] were applied to device [USBXHCI:PCI\\VEN_8086] - class [USBXHCI2].\n\nFlags source: applied through compatibility database.\"\tInformation\tMicrosoft-Windows-Kernel-ShimEngine/Operational\tMicrosoft-Windows-Kernel-ShimEngine\n05.09.2026 08:28:50.510\t4\t\"Flags [5242880] were applied to device [USBXHCI:PCI\\VEN_8086&DEV_7EC0] - class [USBXHCI2].\n\nFlags source: applied through compatibility database.\"\tInformation\tMicrosoft-Windows-Kernel-ShimEngine/Operational\tMicrosoft-Windows-Kernel-ShimEngine\n05.09.2026 08:28:50.520\t7005\t7005 - Wi-Fi Driver Info\tInformation\tSystem\tNetwtw14\n05.09.2026 08:28:50.520\t7002\t7002 - Wi-Fi Driver Info\tInformation\tSystem\tNetwtw14\n05.09.2026 08:28:50.544\t55\t\"Processor 17 in group 0 exposes the following power management capabilities:\n\nIdle state type: Micro Power Engine Plugin (11 state(s))\n\nPerformance state type: ACPI Collaborative Processor Performance Control\nNominal Frequency (MHz): 2500\nMaximum performance percentage: 100\nMinimum performance percentage: 44\nMinimum throttle percentage: 4\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:28:50.630\t7010\t7010 - Wi-Fi Driver Enabled\tInformation\tSystem\tNetwtw14\n05.09.2026 08:28:50.725\t7017\t7017 - Wi-Fi Driver Info\tInformation\tSystem\tNetwtw14\n05.09.2026 08:28:50.737\t4688\t\"A new process has been created.\n\nCreator Subject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x3E7\n\nTarget Subject:\n\tSecurity ID:\t\tS-1-0-0\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x0\n\nProcess Information:\n\tNew Process ID:\t\t0x4b0\n\tNew Process Name:\tC:\\Windows\\System32\\smss.exe\n\tToken Elevation Type:\tTokenElevationTypeDefault (1)\n\tMandatory Label:\t\tS-1-16-16384\n\tCreator Process ID:\t0x3d0\n\tCreator Process Name:\tC:\\Windows\\System32\\smss.exe\n\tProcess Command Line:\t\n\nToken Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.\n\nType 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.\n\nType 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.\n\nType 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:50.816\t521\tActive battery count change.\tInformation\tSystem\tMicrosoft-Windows-Kernel-Power\n05.09.2026 08:28:50.817\t521\tActive battery count change.\tInformation\tSystem\tMicrosoft-Windows-Kernel-Power\n05.09.2026 08:28:50.833\t1\t[PDO] (0x0000.0x15.0x00): Begin state transition from UNINITIALIZED to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.833\t1\t[PDO] (0x0000.0x15.0x01): Begin state transition from UNINITIALIZED to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.834\t1\t[PDO] (0x0000.0x1f.0x03): Begin state transition from UNINITIALIZED to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.866\t1\t[PDO] (0x0000.0x15.0x00): Finish state transition to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.866\t1\t[PDO] (0x0000.0x15.0x01): Finish state transition to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.866\t1\t[PDO] (0x0000.0x1f.0x03): Finish state transition to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:51.002\t29\tFX module is not supported in BIOS:  {bd99c961-c94e-49ce-b543-278c3fb63dfc} from \\??\\C:\\Windows\\System32\\DriverStore\\FileRepository\\intcoed_oemlibpath.inf_amd64_9a2d872508d0a9f2\\mtl_dtspp_2inst_lib.bin.\tInformation\tSystem\tIntel-SST-OED\n05.09.2026 08:28:51.002\t28\tLibrary is not supported in BIOS: \\??\\C:\\Windows\\System32\\DriverStore\\FileRepository\\intcoed_oemlibpath.inf_amd64_9a2d872508d0a9f2\\mtl_dtspp_2inst_lib.bin, status = The request is not supported..\tInformation\tSystem\tIntel-SST-OED\n05.09.2026 08:28:51.189\t28\tLoaded DSP FW library: Libs\\dsp_lib_asrc_mtl_release.bin, status = STATUS_SUCCESS.\tInformation\tSystem\tIntel-SST-OED\n05.09.2026 08:28:51.221\t28\tLoaded DSP FW library: Libs\\dsp_lib_intel_wov_mtl_release.bin, status = STATUS_SUCCESS.\tInformation\tSystem\tIntel-SST-OED\n05.09.2026 08:28:51.242\t28\tLoaded DSP FW library: Libs\\dsp_lib_nld_mtl_release.bin, status = STATUS_SUCCESS.\tInformation\tSystem\tIntel-SST-OED\n05.09.2026 08:28:51.276\t28\tLoaded DSP FW library: Libs\\dsp_lib_whm_mtl_release.bin, status = STATUS_SUCCESS.\tInformation\tSystem\tIntel-SST-OED\n05.09.2026 08:28:51.327\t28\tLoaded DSP FW library: \\??\\C:\\Windows\\System32\\DriverStore\\FileRepository\\intcoed_oemlibpath.inf_amd64_9a2d872508d0a9f2\\mtl_nahimic_2inst_lib.bin, status = STATUS_SUCCESS.\tInformation\tSystem\tIntel-SST-OED\n05.09.2026 08:28:51.331\t10118\tUMDF reflector is unable to connect to service control manager (SCM). This is expected during boot, when SCM has not started yet. Will retry when it starts.\tInformation\tSystem\tMicrosoft-Windows-DriverFrameworks-UserMode\n05.09.2026 08:28:51.331\t219\t\"The driver \\Driver\\WUDFRd failed to load.\nDevice: INTELAUDIO\\DIF_0000&UIF_0000&CTLR_DEV_7E28&VEN_8086&DetectionVerification\\5&4672bc9&0&DIF_0000&UIF_0000\nStatus: 0xC0000365\"\tWarning\tSystem\tMicrosoft-Windows-Kernel-PnP\n05.09.2026 08:28:53.844\t1006\tFor internal use only.\tInformation\tMicrosoft-Windows-Partition/Diagnostic\tMicrosoft-Windows-Partition\n05.09.2026 08:28:53.845\t207\t\"Physical disk {f721584f-c93a-4df4-f37c-1fcee53cc736} arrived.                  \nPool Id: {00000000-0000-0000-0000-000000000000}                  \nDrive Number: 1                  \nDrive Manufacturer: Seagate                  \nDrive Model Number: Backup+ SL                  \nDrive Serial Number: NA5161RS\"\tInformation\tMicrosoft-Windows-StorageSpaces-Driver/Operational\tMicrosoft-Windows-StorageSpaces-Driver\n05.09.2026 08:28:53.845\t1001\tVolume arrived: volume 8 disk 1 offset 32256.\tInformation\tMicrosoft-Windows-StorageVolume/Operational\tMicrosoft-Windows-StorageVolume\n05.09.2026 08:28:53.845\t1001\tVolume arrived: volume 9 disk 1 offset 214818619392.\tInformation\tMicrosoft-Windows-StorageVolume/Operational\tMicrosoft-Windows-StorageVolume\n05.09.2026 08:28:53.845\t1001\tVolume arrived: volume 10 disk 1 offset 916314914816.\tInformation\tMicrosoft-Windows-StorageVolume/Operational\tMicrosoft-Windows-StorageVolume\n05.09.2026 08:28:54.625\t142\t\"Summary of disk space usage, since last event:\n\n           Available space was between 170.13 GB and 170.42 GB\n           Change in available space: 304.44 MB\n           \n           Available clusters were between: 44596390 and 44674326\n           Reserved clusters were between: 76613 and 76613\n           Txf abort reserved clusters were between: 1024 and 1024\n           \n           Elapsed seconds: 0\n           \n           Pagefile size: 0 Bytes\n           Volume size: 300 GB\n           Bytes per cluster: 4096\n           \n           Volume guid: {23606dfe-da07-4ad7-8798-8deaced0a66e}\n           Volume name: C:\n           Is boot volume: true\n           \n           Cached runs miss counts:\n               For MFT: 0\n               For MFT zone: 0\n               Everything else: 0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:54.660\t142\t\"Summary of disk space usage, since last event:\n\n           Available space was between 611.77 GB and 611.82 GB\n           Change in available space: 50.75 MB\n           \n           Available clusters were between: 160370489 and 160383479\n           Reserved clusters were between: 11920 and 11920\n           Txf abort reserved clusters were between: 1024 and 1024\n           \n           Elapsed seconds: 0\n           \n           Pagefile size: 0 Bytes\n           Volume size: 626.66 GB\n           Bytes per cluster: 4096\n           \n           Volume guid: {b4de30fc-d998-46fa-9187-a8f915fd81fc}\n           Volume name: D:\n           Is boot volume: false\n           \n           Cached runs miss counts:\n               For MFT: 0\n               For MFT zone: 0\n               Everything else: 0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:54.673\t142\t\"Summary of disk space usage, since last event:\n\n           Available space was between 58.59 MB and 62.59 MB\n           Change in available space: 4 MB\n           \n           Available clusters were between: 14998 and 16022\n           Reserved clusters were between: 0 and 0\n           Txf abort reserved clusters were between: 1024 and 1024\n           \n           Elapsed seconds: 0\n           \n           Pagefile size: 0 Bytes\n           Volume size: 1024 MB\n           Bytes per cluster: 4096\n           \n           Volume guid: {580f6681-a25f-4cec-9096-3d65cabf1f4a}\n           Volume name: \\\\?\\Volume{580f6681-a25f-4cec-9096-3d65cabf1f4a}\n           Is boot volume: false\n           \n           Cached runs miss counts:\n               For MFT: 0\n               For MFT zone: 2\n               Everything else: 0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:54.673\t142\t\"Summary of disk space usage, since last event:\n\n           Available space was between 9.24 GB and 9.24 GB\n           Change in available space: 4 MB\n           \n           Available clusters were between: 2419681 and 2420705\n           Reserved clusters were between: 0 and 0\n           Txf abort reserved clusters were between: 1024 and 1024\n           \n           Elapsed seconds: 0\n           \n           Pagefile size: 0 Bytes\n           Volume size: 25 GB\n           Bytes per cluster: 4096\n           \n           Volume guid: {f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n           Volume name: \\\\?\\Volume{f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n           Is boot volume: false\n           \n           Cached runs miss counts:\n               For MFT: 0\n               For MFT zone: 2\n               Everything else: 0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:54.674\t9\t\"NTFS scanned entire volume bitmap.\n\n           Volume correlation Id: {23606dfe-da07-4ad7-8798-8deaced0a66e}\n           Volume name: C:\n           Volume label: Windows\n\n           Device name: \\Device\\HarddiskVolume3\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n\n           Duration (micro seconds): 33325\n           InputFlags: 0x10\n           Reason: Proactive background scan to repopulate cached runs\n           Flags: 0x10\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:54.674\t10\t\"NTFS cached runs statistics.\n\n           Volume correlation Id: {23606dfe-da07-4ad7-8798-8deaced0a66e}\n           Volume name: C:\n           Volume label: Windows\n\n           Device name: \\Device\\HarddiskVolume3\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n\n           Media type: Hard disk\n           Runs cached: 10992\n           Longest run cached: 73.38 GB\n           Most populated bin Count: 3288\n           Most populated bin's minimum length: 16 KB\n           Most populated bin's maximum length: 16 KB\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:54.674\t9\t\"NTFS scanned entire volume bitmap.\n\n           Volume correlation Id: {b4de30fc-d998-46fa-9187-a8f915fd81fc}\n           Volume name: D:\n           Volume label: Data\n\n           Device name: \\Device\\HarddiskVolume4\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n\n           Duration (micro seconds): 13072\n           InputFlags: 0x10\n           Reason: Proactive background scan to repopulate cached runs\n           Flags: 0x10\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:54.674\t10\t\"NTFS cached runs statistics.\n\n           Volume correlation Id: {b4de30fc-d998-46fa-9187-a8f915fd81fc}\n           Volume name: D:\n           Volume label: Data\n\n           Device name: \\Device\\HarddiskVolume4\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n\n           Media type: Hard disk\n           Runs cached: 11\n           Longest run cached: 607.51 GB\n           Most populated bin Count: 3\n           Most populated bin's minimum length: 992.01 MB\n           Most populated bin's maximum length: -\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:54.674\t9\t\"NTFS scanned entire volume bitmap.\n\n           Volume correlation Id: {580f6681-a25f-4cec-9096-3d65cabf1f4a}\n           Volume name: \\\\?\\Volume{580f6681-a25f-4cec-9096-3d65cabf1f4a}\n           Volume label: WinRE\n\n           Device name: \\Device\\HarddiskVolume7\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n\n           Duration (micro seconds): 50\n           InputFlags: 0x10\n           Reason: Proactive background scan to repopulate cached runs\n           Flags: 0x10\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:54.674\t10\t\"NTFS cached runs statistics.\n\n           Volume correlation Id: {580f6681-a25f-4cec-9096-3d65cabf1f4a}\n           Volume name: \\\\?\\Volume{580f6681-a25f-4cec-9096-3d65cabf1f4a}\n           Volume label: WinRE\n\n           Device name: \\Device\\HarddiskVolume7\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n\n           Media type: Hard disk\n           Runs cached: 2\n           Longest run cached: 32.05 MB\n           Most populated bin Count: 1\n           Most populated bin's minimum length: 30.01 MB\n           Most populated bin's maximum length: 31 MB\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:54.674\t9\t\"NTFS scanned entire volume bitmap.\n\n           Volume correlation Id: {f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n           Volume name: \\\\?\\Volume{f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n           Volume label: Onekey\n\n           Device name: \\Device\\HarddiskVolume6\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n\n           Duration (micro seconds): 842\n           InputFlags: 0x10\n           Reason: Proactive background scan to repopulate cached runs\n           Flags: 0x10\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:54.674\t10\t\"NTFS cached runs statistics.\n\n           Volume correlation Id: {f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n           Volume name: \\\\?\\Volume{f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n           Volume label: Onekey\n\n           Device name: \\Device\\HarddiskVolume6\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n\n           Media type: Hard disk\n           Runs cached: 2\n           Longest run cached: 9.04 GB\n           Most populated bin Count: 1\n           Most populated bin's minimum length: 192.01 MB\n           Most populated bin's maximum length: 200 MB\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:54.888\t204\tStart of StartUSBVideoDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:54.888\t227\tUsbVideo camera has valid configuration\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:54.888\t205\tStop of StartUSBVideoDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:54.913\t206\tKS_WNF Register.\tInformation\tMicrosoft-Windows-KernelStreaming/Operational\tMicrosoft-Windows-KernelStreaming\n05.09.2026 08:28:54.914\t206\tStart of StopUSBVideoDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:54.914\t207\tStop of StopUSBVideoDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:54.914\t215\tStart of PowerIrpCompletion\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:54.914\t216\tStop of PowerIrpCompletion\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:54.927\t18\tWindows cannot store Bluetooth authentication codes (link keys) on the local adapter. Bluetooth keyboards might not work in the system BIOS during startup.\tInformation\tSystem\tBTHUSB\n05.09.2026 08:28:54.938\t100\t\"The volume snapshot driver has begun processing for volume online.\n\nVolume GUID: {5285d7ae-0000-0000-007e-000000000000}\n\nGuidance:\nWhen a volume is brought online the volume snapshot driver scans for any persistent snapshots that may be on the volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:54.939\t101\t\"The volume snapshot driver has completed processing for volume online.\n\nVolume GUID: {5285d7ae-0000-0000-007e-000000000000}\n\nGuidance:\nThe volume snapshot driver was able to scan for any persistent snapshots on this volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:54.940\t100\t\"The volume snapshot driver has begun processing for volume online.\n\nVolume GUID: {5285d7ae-0000-0000-0000-300432000000}\n\nGuidance:\nWhen a volume is brought online the volume snapshot driver scans for any persistent snapshots that may be on the volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:54.960\t101\t\"The volume snapshot driver has completed processing for volume online.\n\nVolume GUID: {5285d7ae-0000-0000-0000-300432000000}\n\nGuidance:\nThe volume snapshot driver was able to scan for any persistent snapshots on this volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:54.960\t100\t\"The volume snapshot driver has begun processing for volume online.\n\nVolume GUID: {5285d7ae-0000-0000-0000-a058d5000000}\n\nGuidance:\nWhen a volume is brought online the volume snapshot driver scans for any persistent snapshots that may be on the volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:54.964\t10\tCrash dump disabled.\tInformation\tMicrosoft-Windows-Kernel-Dump/Operational\tMicrosoft-Windows-Kernel-Dump\n05.09.2026 08:28:54.991\t101\tInitialized VolumeCacheMap for device guid: {5285d7ae-0000-0000-007e-000000000000}.\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:28:54.991\t101\t\"The volume snapshot driver has completed processing for volume online.\n\nVolume GUID: {5285d7ae-0000-0000-0000-a058d5000000}\n\nGuidance:\nThe volume snapshot driver was able to scan for any persistent snapshots on this volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:55.009\t4688\t\"A new process has been created.\n\nCreator Subject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x3E7\n\nTarget Subject:\n\tSecurity ID:\t\tS-1-0-0\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x0\n\nProcess Information:\n\tNew Process ID:\t\t0x560\n\tNew Process Name:\tC:\\Windows\\System32\\csrss.exe\n\tToken Elevation Type:\tTokenElevationTypeDefault (1)\n\tMandatory Label:\t\tS-1-16-16384\n\tCreator Process ID:\t0x4b0\n\tCreator Process Name:\tC:\\Windows\\System32\\smss.exe\n\tProcess Command Line:\t\n\nToken Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.\n\nType 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.\n\nType 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.\n\nType 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:55.369\t4\t\"The NTFS volume has been successfully mounted.\n\n           Volume correlation Id: {5285d7ae-0000-0000-007e-000000000000}\n           Volume name: E:\n           Volume label: HDD Seagate 1TB Backup+ S\n\n           Device name: \\Device\\HarddiskVolume8\n           Device GUID: {f721584f-c93a-4df4-f37c-1fcee53cc736}\n           Device manufacturer: Seagate \n           Device model: Backup+ SL      \n           Device revision: 0409\n           Device serial number: NA5161RS\n           Bus type: USB\n           Device number: 1\n           Boot partition: false\n\n           Native NVMe: false\n\n           Adapter serial number: \n           \n           Total mount duration: 398 ms\n           Longest stage: 8. Duration 177 ms (45% of the total)\n           Second longest stage: 7. Duration 94 ms (24% of the total)\n           Volume restart applied: false\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:55.370\t98\tVolume E: (\\Device\\HarddiskVolume8) is healthy.  No action is needed.\tInformation\tSystem\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:55.370\t9\t\"NTFS scanned entire volume bitmap.\n\n           Volume correlation Id: {5285d7ae-0000-0000-007e-000000000000}\n           Volume name: E:\n           Volume label: HDD Seagate 1TB Backup+ S\n\n           Device name: \\Device\\HarddiskVolume8\n           Device GUID: {f721584f-c93a-4df4-f37c-1fcee53cc736}\n           Device manufacturer: Seagate \n           Device model: Backup+ SL      \n           Device revision: 0409\n           Device serial number: NA5161RS\n           Bus type: USB\n           Native NVMe: false\n\n           Adapter serial number: \n\n           Duration (micro seconds): 82525\n           InputFlags: 0xE\n           Reason: Mount\n           Flags: 0x10\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:55.370\t10\t\"NTFS cached runs statistics.\n\n           Volume correlation Id: {5285d7ae-0000-0000-007e-000000000000}\n           Volume name: E:\n           Volume label: HDD Seagate 1TB Backup+ S\n\n           Device name: \\Device\\HarddiskVolume8\n           Device GUID: {f721584f-c93a-4df4-f37c-1fcee53cc736}\n           Device manufacturer: Seagate \n           Device model: Backup+ SL      \n           Device revision: 0409\n           Device serial number: NA5161RS\n           Bus type: USB\n           Native NVMe: false\n\n           Adapter serial number: \n\n           Media type: Hard disk\n           Runs cached: 161\n           Longest run cached: 23.86 GB\n           Most populated bin Count: 16\n           Most populated bin's minimum length: 992.01 MB\n           Most populated bin's maximum length: -\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:55.540\t101\tInitialized VolumeCacheMap for device guid: {5285d7ae-0000-0000-0000-300432000000}.\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:28:55.548\t1\t\tInformation\tSystem\tWDTDrv\n05.09.2026 08:28:55.712\t4688\t\"A new process has been created.\n\nCreator Subject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x3E7\n\nTarget Subject:\n\tSecurity ID:\t\tS-1-0-0\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x0\n\nProcess Information:\n\tNew Process ID:\t\t0x5e8\n\tNew Process Name:\tC:\\Windows\\System32\\smss.exe\n\tToken Elevation Type:\tTokenElevationTypeDefault (1)\n\tMandatory Label:\t\tS-1-16-16384\n\tCreator Process ID:\t0x3d0\n\tCreator Process Name:\tC:\\Windows\\System32\\smss.exe\n\tProcess Command Line:\t\n\nToken Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.\n\nType 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.\n\nType 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.\n\nType 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:55.715\t4688\t\"A new process has been created.\n\nCreator Subject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x3E7\n\nTarget Subject:\n\tSecurity ID:\t\tS-1-0-0\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x0\n\nProcess Information:\n\tNew Process ID:\t\t0x5f0\n\tNew Process Name:\tC:\\Windows\\System32\\wininit.exe\n\tToken Elevation Type:\tTokenElevationTypeDefault (1)\n\tMandatory Label:\t\tS-1-16-16384\n\tCreator Process ID:\t0x4b0\n\tCreator Process Name:\tC:\\Windows\\System32\\smss.exe\n\tProcess Command Line:\t\n\nToken Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.\n\nType 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.\n\nType 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.\n\nType 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:55.716\t4688\t\"A new process has been created.\n\nCreator Subject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x3E7\n\nTarget Subject:\n\tSecurity ID:\t\tS-1-0-0\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x0\n\nProcess Information:\n\tNew Process ID:\t\t0x5f8\n\tNew Process Name:\tC:\\Windows\\System32\\csrss.exe\n\tToken Elevation Type:\tTokenElevationTypeDefault (1)\n\tMandatory Label:\t\tS-1-16-16384\n\tCreator Process ID:\t0x5e8\n\tCreator Process Name:\tC:\\Windows\\System32\\smss.exe\n\tProcess Command Line:\t\n\nToken Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.\n\nType 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.\n\nType 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.\n\nType 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:55.731\t19\t\"Virtualization Based Security new timer creation status\n\nHRESULT: The operation completed successfully.\nNew latch timer needed: false\nNew latch timer waiting for system update completion: false\nPrevious latch timer exists but disabled by registry: false\nPolicy file exists: false\n\"\tInformation\tSystem\tMicrosoft-Windows-Wininit\n05.09.2026 08:28:55.731\t24\t\"Boot App Anti-Rollback: Timer start completed with status:\n\nWin32Error: 0\nStart time: \u200e2026\u200e-\u200e08\u200e-\u200e12T18:07:00.129105700Z\nGrace period: 51840000000000\nDue time: \u200e2026\u200e-\u200e10\u200e-\u200e11T18:07:00.129105700Z\n\"\tInformation\tSystem\tMicrosoft-Windows-Wininit\n05.09.2026 08:28:55.731\t25\t\"Boot App Anti-Rollback: Previous timer resumed with status:\n\nHRESULT: The operation completed successfully.\nPrevious timer present: true\nStart time: \u200e2026\u200e-\u200e08\u200e-\u200e12T18:07:00.129105700Z\nGrace period: 51840000000000\nAttempted recovery enforcement succeeded: false\n\"\tInformation\tSystem\tMicrosoft-Windows-Wininit\n05.09.2026 08:28:55.731\t23\t\"Boot App Anti-Rollback: Initialize Completed with status:\nHRESULT: The operation completed successfully.\nNew timer needed: false\nNew timer waiting for system update completion: false\nPrevious latch timer exists but disabled by registry: false\n\"\tInformation\tSystem\tMicrosoft-Windows-Wininit\n05.09.2026 08:28:55.987\t4\t\"The NTFS volume has been successfully mounted.\n\n           Volume correlation Id: {5285d7ae-0000-0000-0000-300432000000}\n           Volume name: F:\n           Volume label: HDD Seagate 1TB Backup+ S\n\n           Device name: \\Device\\HarddiskVolume9\n           Device GUID: {f721584f-c93a-4df4-f37c-1fcee53cc736}\n           Device manufacturer: Seagate \n           Device model: Backup+ SL      \n           Device revision: 0409\n           Device serial number: NA5161RS\n           Bus type: USB\n           Device number: 1\n           Boot partition: false\n\n           Native NVMe: false\n\n           Adapter serial number: \n           \n           Total mount duration: 457 ms\n           Longest stage: 7. Duration 246 ms (54% of the total)\n           Second longest stage: 8. Duration 156 ms (34% of the total)\n           Volume restart applied: false\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:55.987\t98\tVolume F: (\\Device\\HarddiskVolume9) is healthy.  No action is needed.\tInformation\tSystem\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:55.987\t9\t\"NTFS scanned entire volume bitmap.\n\n           Volume correlation Id: {5285d7ae-0000-0000-0000-300432000000}\n           Volume name: F:\n           Volume label: HDD Seagate 1TB Backup+ S\n\n           Device name: \\Device\\HarddiskVolume9\n           Device GUID: {f721584f-c93a-4df4-f37c-1fcee53cc736}\n           Device manufacturer: Seagate \n           Device model: Backup+ SL      \n           Device revision: 0409\n           Device serial number: NA5161RS\n           Bus type: USB\n           Native NVMe: false\n\n           Adapter serial number: \n\n           Duration (micro seconds): 228940\n           InputFlags: 0xE\n           Reason: Mount\n           Flags: 0x10\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:55.987\t10\t\"NTFS cached runs statistics.\n\n           Volume correlation Id: {5285d7ae-0000-0000-0000-300432000000}\n           Volume name: F:\n           Volume label: HDD Seagate 1TB Backup+ S\n\n           Device name: \\Device\\HarddiskVolume9\n           Device GUID: {f721584f-c93a-4df4-f37c-1fcee53cc736}\n           Device manufacturer: Seagate \n           Device model: Backup+ SL      \n           Device revision: 0409\n           Device serial number: NA5161RS\n           Bus type: USB\n           Native NVMe: false\n\n           Adapter serial number: \n\n           Media type: Hard disk\n           Runs cached: 1036\n           Longest run cached: 37.35 MB\n           Most populated bin Count: 38\n           Most populated bin's minimum length: 8 KB\n           Most populated bin's maximum length: 8 KB\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:56.220\t101\tInitialized VolumeCacheMap for device guid: {5285d7ae-0000-0000-0000-a058d5000000}.\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:28:56.502\t4\t\"The NTFS volume has been successfully mounted.\n\n           Volume correlation Id: {5285d7ae-0000-0000-0000-a058d5000000}\n           Volume name: G:\n           Volume label: HDD Seagate 1TB Backup+ S\n\n           Device name: \\Device\\HarddiskVolume10\n           Device GUID: {f721584f-c93a-4df4-f37c-1fcee53cc736}\n           Device manufacturer: Seagate \n           Device model: Backup+ SL      \n           Device revision: 0409\n           Device serial number: NA5161RS\n           Bus type: USB\n           Device number: 1\n           Boot partition: false\n\n           Native NVMe: false\n\n           Adapter serial number: \n           \n           Total mount duration: 345 ms\n           Longest stage: 8. Duration 125 ms (36% of the total)\n           Second longest stage: 7. Duration 62 ms (18% of the total)\n           Volume restart applied: false\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:56.502\t98\tVolume G: (\\Device\\HarddiskVolume10) is healthy.  No action is needed.\tInformation\tSystem\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:56.502\t9\t\"NTFS scanned entire volume bitmap.\n\n           Volume correlation Id: {5285d7ae-0000-0000-0000-a058d5000000}\n           Volume name: G:\n           Volume label: HDD Seagate 1TB Backup+ S\n\n           Device name: \\Device\\HarddiskVolume10\n           Device GUID: {f721584f-c93a-4df4-f37c-1fcee53cc736}\n           Device manufacturer: Seagate \n           Device model: Backup+ SL      \n           Device revision: 0409\n           Device serial number: NA5161RS\n           Bus type: USB\n           Native NVMe: false\n\n           Adapter serial number: \n\n           Duration (micro seconds): 37990\n           InputFlags: 0xE\n           Reason: Mount\n           Flags: 0x10\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:56.502\t10\t\"NTFS cached runs statistics.\n\n           Volume correlation Id: {5285d7ae-0000-0000-0000-a058d5000000}\n           Volume name: G:\n           Volume label: HDD Seagate 1TB Backup+ S\n\n           Device name: \\Device\\HarddiskVolume10\n           Device GUID: {f721584f-c93a-4df4-f37c-1fcee53cc736}\n           Device manufacturer: Seagate \n           Device model: Backup+ SL      \n           Device revision: 0409\n           Device serial number: NA5161RS\n           Bus type: USB\n           Native NVMe: false\n\n           Adapter serial number: \n\n           Media type: Hard disk\n           Runs cached: 193\n           Longest run cached: 4.90 GB\n           Most populated bin Count: 68\n           Most populated bin's minimum length: 0 Bytes\n           Most populated bin's maximum length: 4 KB\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:56.556\t10\t\tError\tIntel-Gfx-Display-External/GfxDisplayExEventViewer\tIntel-Gfx-Display-External\n05.09.2026 08:28:56.782\t10\t\tError\tIntel-Gfx-Display-External/GfxDisplayExEventViewer\tIntel-Gfx-Display-External\n05.09.2026 08:28:57.027\t25\tThe shadow copies of volume C: were deleted because the shadow copy storage could not grow in time.  Consider reducing the IO load on the system or choose a shadow copy storage volume that is not being shadow copied.\tError\tSystem\tVolsnap\n05.09.2026 08:28:57.080\t4688\t\"A new process has been created.\n\nCreator Subject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x3E7\n\nTarget Subject:\n\tSecurity ID:\t\tS-1-0-0\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x0\n\nProcess Information:\n\tNew Process ID:\t\t0x66c\n\tNew Process Name:\tC:\\Windows\\System32\\winlogon.exe\n\tToken Elevation Type:\tTokenElevationTypeDefault (1)\n\tMandatory Label:\t\tS-1-16-16384\n\tCreator Process ID:\t0x5e8\n\tCreator Process Name:\tC:\\Windows\\System32\\smss.exe\n\tProcess Command Line:\t\n\nToken Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.\n\nType 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.\n\nType 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.\n\nType 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.081\t1010\t\"Device STORAGE\\VolumeSnapshot\\HarddiskVolumeSnapshot1 has been surprise removed as it is reported as missing on the bus.\nCount of devices removed: 1\"\tInformation\tMicrosoft-Windows-Kernel-PnP/Device Management\tMicrosoft-Windows-Kernel-PnP\n05.09.2026 08:28:57.082\t1010\t\"Device STORAGE\\VolumeSnapshot\\HarddiskVolumeSnapshot2 has been surprise removed as it is reported as missing on the bus.\nCount of devices removed: 1\"\tInformation\tMicrosoft-Windows-Kernel-PnP/Device Management\tMicrosoft-Windows-Kernel-PnP\n05.09.2026 08:28:57.082\t1010\t\"Device STORAGE\\VolumeSnapshot\\HarddiskVolumeSnapshot3 has been surprise removed as it is reported as missing on the bus.\nCount of devices removed: 1\"\tInformation\tMicrosoft-Windows-Kernel-PnP/Device Management\tMicrosoft-Windows-Kernel-PnP\n05.09.2026 08:28:57.082\t300\t\"NTFS volume dismount has started.\n\n           Volume correlation Id: {5772ff22-a7ee-11f1-b7fe-289200f24a99}\n           Volume name: \n           Volume label: Windows\n\n           Device name: \\Device\\HarddiskVolumeShadowCopy3\n           Device GUID: {00000000-0000-0000-0000-000000000000}\n           Device manufacturer: \n           Device model: \n           Device revision: \n           Device serial number: \n           Bus type: \n           Native NVMe: false\n           \n           Adapter serial number: \n           \n           Process Id: 4\n           Process name: System\n           \n           Reason: Surprise removal\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:57.083\t303\t\"The NTFS volume has successfully dismounted.\n\n           Volume correlation Id: {5772ff22-a7ee-11f1-b7fe-289200f24a99}\n           Volume name: Windows\n           Volume label: Windows\n\n           Device name: \\Device\\HarddiskVolumeShadowCopy3\n           Device GUID: {00000000-0000-0000-0000-000000000000}\n           Device manufacturer: \n           Device model: \n           Device revision: \n           Device serial number: \n           Bus type: \n           Native NVMe: false\n\n           Adapter serial number: \n           \n           Process Id: 4\n           Process name: System\n           \n           Reason: Surprise removal\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:57.098\t4688\t\"A new process has been created.\n\nCreator Subject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x3E7\n\nTarget Subject:\n\tSecurity ID:\t\tS-1-0-0\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x0\n\nProcess Information:\n\tNew Process ID:\t\t0x68c\n\tNew Process Name:\tC:\\Windows\\System32\\services.exe\n\tToken Elevation Type:\tTokenElevationTypeDefault (1)\n\tMandatory Label:\t\tS-1-16-16384\n\tCreator Process ID:\t0x5f0\n\tCreator Process Name:\tC:\\Windows\\System32\\wininit.exe\n\tProcess Command Line:\t\n\nToken Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.\n\nType 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.\n\nType 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.\n\nType 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.116\t14\t\"Credential Guard configuration:\n\nRegistry Configuration: 0x0\nTest Configuration: 0\nAuto Enablement: 0\"\tInformation\tSystem\tMicrosoft-Windows-Wininit\n05.09.2026 08:28:57.120\t5\tSecure Trustlet NULL Id 0 and Pid 0 started with status STATUS_SUCCESS.\tInformation\tSystem\tMicrosoft-Windows-IsolatedUserMode\n05.09.2026 08:28:57.120\t1\tSecure Trustlet \\??\\C:\\WINDOWS\\system32\\lsaiso.exe Id 1 and Pid 1720 started with status STATUS_SUCCESS.\tInformation\tSystem\tMicrosoft-Windows-IsolatedUserMode\n05.09.2026 08:28:57.120\t4688\t\"A new process has been created.\n\nCreator Subject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x3E7\n\nTarget Subject:\n\tSecurity ID:\t\tS-1-0-0\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x0\n\nProcess Information:\n\tNew Process ID:\t\t0x6b8\n\tNew Process Name:\tC:\\Windows\\System32\\LsaIso.exe\n\tToken Elevation Type:\tTokenElevationTypeDefault (1)\n\tMandatory Label:\t\tS-1-16-16384\n\tCreator Process ID:\t0x5f0\n\tCreator Process Name:\tC:\\Windows\\System32\\wininit.exe\n\tProcess Command Line:\t\n\nToken Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.\n\nType 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.\n\nType 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.\n\nType 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.121\t18\tVBS Key Isolation was started and will protect VSM-isolated keys.\tInformation\tSystem\tMicrosoft-Windows-Wininit\n05.09.2026 08:28:57.124\t4688\t\"A new process has been created.\n\nCreator Subject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x3E7\n\nTarget Subject:\n\tSecurity ID:\t\tS-1-0-0\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x0\n\nProcess Information:\n\tNew Process ID:\t\t0x6c4\n\tNew Process Name:\tC:\\Windows\\System32\\lsass.exe\n\tToken Elevation Type:\tTokenElevationTypeDefault (1)\n\tMandatory Label:\t\tS-1-16-16384\n\tCreator Process ID:\t0x5f0\n\tCreator Process Name:\tC:\\Windows\\System32\\wininit.exe\n\tProcess Command Line:\t\n\nToken Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.\n\nType 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.\n\nType 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.\n\nType 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.352\t6156\t\"Credential Guard auto enablement status.\n\nHardware Requirements for Virtualization Based Security:\t1\nDomain Joined:\t0\nAzure AD Joined:\t0\n Licensed for Credential Guard:\t0\nDomain Controller:\t0\"\tInformation\tSystem\tLsaSrv\n05.09.2026 08:28:57.358\t6417\t\"The FIPS mode crypto selftests succeeded.\n\n\tProcess ID:\t\t0x6c4\n\tProcess Name:\t\tC:\\Windows\\System32\\lsass.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.359\t4608\t\"Windows is starting up.\n\nThis event is logged when LSASS.EXE starts and the auditing subsystem is initialized.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.361\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-0-0\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x0\n\nLogon Information:\n\tLogon Type:\t\t0\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\t-\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x4\n\tProcess Name:\t\t\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\t-\n\tAuthentication Package:\t-\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.398\t5\tSecure Trustlet NULL Id 0 and Pid 0 started with status STATUS_SUCCESS.\tInformation\tSystem\tMicrosoft-Windows-IsolatedUserMode\n05.09.2026 08:28:57.440\t4902\t\"The Per-user audit policy table was created.\n\nNumber of Elements:\t0\nPolicy ID:\t0x14306\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.442\t16962\t\"Remote calls to the SAM database are being restricted using the default security descriptor: O:SYG:SYD:(A;;RC;;;BA).\nFor more information please see http://go.microsoft.com/fwlink/?LinkId=787651.\"\tInformation\tSystem\tMicrosoft-Windows-Directory-Services-SAM\n05.09.2026 08:28:57.447\t16977\t\"The domain is configured with the following minimum password length-related settings.\n\nMinimumPasswordLength: 0\n\nRelaxMinimumPasswordLengthLimits: 0\n\nMinimumPasswordLengthAudit: -1\n\nFor more information see https://go.microsoft.com/fwlink/?LinkId=2097191.\n\"\tInformation\tSystem\tMicrosoft-Windows-Directory-Services-SAM\n05.09.2026 08:28:57.447\t16983\t\"The security account manager is now logging periodic summary events for remote clients that call legacy password change or set RPC methods.\n\nFor more information please see https://go.microsoft.com/fwlink/?linkid=2150956.\n\"\tInformation\tSystem\tMicrosoft-Windows-Directory-Services-SAM\n05.09.2026 08:28:57.458\t4648\t\"A logon was attempted using explicit credentials.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nAccount Whose Credentials Were Used:\n\tAccount Name:\t\tUMFD-0\n\tAccount Domain:\t\tFont Driver Host\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nTarget Server:\n\tTarget Server Name:\tlocalhost\n\tAdditional Information:\tlocalhost\n\nProcess Information:\n\tProcess ID:\t\t0x5f0\n\tProcess Name:\t\tC:\\Windows\\System32\\wininit.exe\n\nNetwork Information:\n\tNetwork Address:\t-\n\tPort:\t\t\t-\n\nThis event is generated when a process attempts to log on an account by explicitly specifying that account\u2019s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.458\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t2\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tYes\n\tElevated Token:\t\tNo\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-96-0-0\n\tAccount Name:\t\tUMFD-0\n\tAccount Domain:\t\tFont Driver Host\n\tLogon ID:\t\t0x147B8\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x5f0\n\tProcess Name:\t\tC:\\Windows\\System32\\wininit.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.458\t4648\t\"A logon was attempted using explicit credentials.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nAccount Whose Credentials Were Used:\n\tAccount Name:\t\tUMFD-1\n\tAccount Domain:\t\tFont Driver Host\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nTarget Server:\n\tTarget Server Name:\tlocalhost\n\tAdditional Information:\tlocalhost\n\nProcess Information:\n\tProcess ID:\t\t0x66c\n\tProcess Name:\t\tC:\\Windows\\System32\\winlogon.exe\n\nNetwork Information:\n\tNetwork Address:\t-\n\tPort:\t\t\t-\n\nThis event is generated when a process attempts to log on an account by explicitly specifying that account\u2019s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.458\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t2\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tYes\n\tElevated Token:\t\tNo\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-96-0-1\n\tAccount Name:\t\tUMFD-1\n\tAccount Domain:\t\tFont Driver Host\n\tLogon ID:\t\t0x1479A\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x66c\n\tProcess Name:\t\tC:\\Windows\\System32\\winlogon.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.460\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.460\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.467\t40\tAppContainer onecore\\ds\\security\\gina\\profile\\profext\\appcontainer.cpp Line:1863 Usermode Font Driver Host microsoft.windows.fontdrvhost was not created because it already exists.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:28:57.467\t40\tAppContainer onecore\\ds\\security\\gina\\profile\\profext\\appcontainer.cpp Line:1863 Usermode Font Driver Host microsoft.windows.fontdrvhost was not created because it already exists.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:28:57.469\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-19\n\tAccount Name:\t\tLOCAL SERVICE\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E5\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.469\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-19\n\tAccount Name:\t\tLOCAL SERVICE\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E5\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.502\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-20\n\tAccount Name:\t\tNETWORK SERVICE\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E4\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.502\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-20\n\tAccount Name:\t\tNETWORK SERVICE\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E4\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.531\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.531\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.557\t32\tPlugin RDSAppXPlugin has been successfully initialized\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:28:57.582\t4648\t\"A logon was attempted using explicit credentials.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nAccount Whose Credentials Were Used:\n\tAccount Name:\t\tDWM-1\n\tAccount Domain:\t\tWindow Manager\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nTarget Server:\n\tTarget Server Name:\tlocalhost\n\tAdditional Information:\tlocalhost\n\nProcess Information:\n\tProcess ID:\t\t0x66c\n\tProcess Name:\t\tC:\\Windows\\System32\\winlogon.exe\n\nNetwork Information:\n\tNetwork Address:\t-\n\tPort:\t\t\t-\n\nThis event is generated when a process attempts to log on an account by explicitly specifying that account\u2019s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.582\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t2\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tYes\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-90-0-1\n\tAccount Name:\t\tDWM-1\n\tAccount Domain:\t\tWindow Manager\n\tLogon ID:\t\t0x1DD5E\n\tLinked Logon ID:\t\t0x1DDB6\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x66c\n\tProcess Name:\t\tC:\\Windows\\System32\\winlogon.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.582\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t2\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tYes\n\tElevated Token:\t\tNo\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-90-0-1\n\tAccount Name:\t\tDWM-1\n\tAccount Domain:\t\tWindow Manager\n\tLogon ID:\t\t0x1DDB6\n\tLinked Logon ID:\t\t0x1DD5E\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x66c\n\tProcess Name:\t\tC:\\Windows\\System32\\winlogon.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.582\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-90-0-1\n\tAccount Name:\t\tDWM-1\n\tAccount Domain:\t\tWindow Manager\n\tLogon ID:\t\t0x1DD5E\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.582\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-90-0-1\n\tAccount Name:\t\tDWM-1\n\tAccount Domain:\t\tWindow Manager\n\tLogon ID:\t\t0x1DDB6\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeAuditPrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.604\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.604\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.605\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.605\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.605\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.605\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.605\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.605\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.633\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.633\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.633\t4116\tStarted the Group Policy service initialization phase.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.637\t4115\tGroup Policy Service started.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.640\t100\tError 0x15: misuse at line 185353 of [737ae4a347]\tError\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:28:57.640\t811\tThe winlogon notification subscriber  began handling the notification event (0).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:28:57.640\t5324\tGroup Policy received the notification CreateSession from Winlogon for session 1.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.640\t5351\tGroup policy session returned to winlogon.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.640\t812\tThe winlogon notification subscriber  finished handling the notification event (0).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:28:57.640\t4117\tGroup Policy Session started.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.640\t811\tThe winlogon notification subscriber  began handling the notification event (0).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:28:57.640\t5116\tSuccessfully completed the Group Policy Service initialization phase.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.641\t812\tThe winlogon notification subscriber  finished handling the notification event (0).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:28:57.645\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.645\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.655\t223\tStateRepository partition 1 exists and ready for use [SchemaVersion=30464]\tInformation\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:28:57.656\t223\tStateRepository partition 2 exists and ready for use [SchemaVersion=30464]\tInformation\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:28:57.657\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.657\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.661\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.661\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.663\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.663\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.671\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.671\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.676\t284\tREINDEX command has run; database indices are updated [Partition=2, ProcessId=900, Scope=AppInstaller]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:28:57.677\t284\tREINDEX command has run; database indices are updated [Partition=2, ProcessId=900, Scope=AppInstallerUri]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:28:57.682\t284\tREINDEX command has run; database indices are updated [Partition=2, ProcessId=900, Scope=AppxManifest]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:28:57.683\t284\tREINDEX command has run; database indices are updated [Partition=2, ProcessId=900, Scope=AutoUpdatePackage]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:28:57.684\t284\tREINDEX command has run; database indices are updated [Partition=2, ProcessId=900, Scope=ContentGroup]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:28:57.685\t284\tREINDEX command has run; database indices are updated [Partition=2, ProcessId=900, Scope=ContentGroupFile]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:28:57.687\t1\t[PDO] (0x0000.0x04.0x00): Begin state transition from UNINITIALIZED to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:57.689\t50036\tDHCPv4 client service is started\tInformation\tSystem\tMicrosoft-Windows-Dhcp-Client\n05.09.2026 08:28:57.689\t50103\tDHCPv4 client registered for shutdown notification\tInformation\tSystem\tMicrosoft-Windows-Dhcp-Client\n05.09.2026 08:28:57.689\t50036\tDHCPv4 client service is started\tInformation\tSystem\tMicrosoft-Windows-Dhcp-Client\n05.09.2026 08:28:57.692\t1531\t\"The User Profile Service has started successfully.  \n\n\"\tInformation\tApplication\tMicrosoft-Windows-User Profiles Service\n05.09.2026 08:28:57.693\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.693\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.700\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.700\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.702\t51046\tDHCPv6 client service is started\tInformation\tSystem\tMicrosoft-Windows-DHCPv6-Client\n05.09.2026 08:28:57.709\t5320\tThe Group Policy Client service is currently configured as a standalone service.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.709\t5320\tInitializing and reading current service configuration for the Group Policy Client service.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.709\t5320\tInitializing service instance state to detect previous instances of the service.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.709\t5321\tA previous instance of the Group Policy Client Service was detected. Parameter: 951004af-0f05-4884-8338-5516f9f3e36f\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.712\t6\tFile System Filter 'bfs' (10.0, \u200e2089\u200e-\u200e03\u200e-\u200e04T05:46:40.000000000Z) has successfully loaded and registered with Filter Manager.\tInformation\tSystem\tMicrosoft-Windows-FilterManager\n05.09.2026 08:28:57.718\t61\tFrameServer FsmDeviceWatcher InternalUpdateSensorGroups Start\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:28:57.719\t6\tFile System Filter 'wcifs' (10.0, \u200e2093\u200e-\u200e08\u200e-\u200e15T18:45:54.000000000Z) has successfully loaded and registered with Filter Manager.\tInformation\tSystem\tMicrosoft-Windows-FilterManager\n05.09.2026 08:28:57.724\t1\t[PDO] (0x0000.0x04.0x00): Finish state transition to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:57.728\t6\tFile System Filter 'luafv' (10.0, \u200e2080\u200e-\u200e07\u200e-\u200e22T01:18:14.000000000Z) has successfully loaded and registered with Filter Manager.\tInformation\tSystem\tMicrosoft-Windows-FilterManager\n05.09.2026 08:28:57.747\t2\tWCIFS filter registration succeeded\tInformation\tMicrosoft-Windows-Containers-Wcifs/Operational\tMicrosoft-Windows-Containers-Wcifs\n05.09.2026 08:28:57.749\t8025\tThe Microsoft Passport service started successfully.\t16\tMicrosoft-Windows-HelloForBusiness/Operational\tMicrosoft-Windows-HelloForBusiness\n05.09.2026 08:28:57.756\t6\tFile System Filter 'CldFlt' (10.0, \u200e2096\u200e-\u200e07\u200e-\u200e17T03:30:39.000000000Z) has successfully loaded and registered with Filter Manager.\tInformation\tSystem\tMicrosoft-Windows-FilterManager\n05.09.2026 08:28:57.756\t1\tFile System Filter 'CldFlt' (Version 10.0, \u200e2096\u200e-\u200e07\u200e-\u200e17T03:30:39.000000000Z) unloaded successfully.\tInformation\tSystem\tMicrosoft-Windows-FilterManager\n05.09.2026 08:28:57.756\t6\tFile System Filter 'CldFlt' (10.0, \u200e2096\u200e-\u200e07\u200e-\u200e17T03:30:39.000000000Z) has successfully loaded and registered with Filter Manager.\tInformation\tSystem\tMicrosoft-Windows-FilterManager\n05.09.2026 08:28:57.758\t6\tFile System Filter 'UnionFS' (10.0, \u200e2069\u200e-\u200e02\u200e-\u200e06T03:45:31.000000000Z) has successfully loaded and registered with Filter Manager.\tInformation\tSystem\tMicrosoft-Windows-FilterManager\n05.09.2026 08:28:57.759\t2\tCLDFLT registration succeeded\tInformation\tMicrosoft-Windows-CloudFiles-Filter/Operational\tMicrosoft-Windows-CloudFiles-Filter\n05.09.2026 08:28:57.763\t10001\tWCMSVC: Start WCM Service Startup\tInformation\tMicrosoft-Windows-Wcmsvc/Operational\tMicrosoft-Windows-Wcmsvc\n05.09.2026 08:28:57.764\t6\tFile System Filter 'storqosflt' (10.0, \u200e2051\u200e-\u200e09\u200e-\u200e16T09:31:38.000000000Z) has successfully loaded and registered with Filter Manager.\tInformation\tSystem\tMicrosoft-Windows-FilterManager\n05.09.2026 08:28:57.772\t6\tFile System Filter 'bindflt' (10.0, \u200e1997\u200e-\u200e10\u200e-\u200e04T07:48:21.000000000Z) has successfully loaded and registered with Filter Manager.\tInformation\tSystem\tMicrosoft-Windows-FilterManager\n05.09.2026 08:28:57.773\t2\tBINDFLT filter registration succeeded\tInformation\tMicrosoft-Windows-Containers-BindFlt/Operational\tMicrosoft-Windows-Containers-BindFlt\n05.09.2026 08:28:57.777\t200\tStart of PowerUpDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.777\t201\tStop of PowerUpDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.777\t217\tFilterIrp Pending\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.789\t1003\t\"CDE reported a state change \n\n State: Disconnected. Service is not started. \n\n Name: Wlansvc.\"\tInformation\tMicrosoft-Windows-Wcmsvc/Operational\tMicrosoft-Windows-Wcmsvc\n05.09.2026 08:28:57.789\t1003\t\"CDE reported a state change \n\n State: Disconnected. Service is not started. \n\n Name: Wwansvc.\"\tInformation\tMicrosoft-Windows-Wcmsvc/Operational\tMicrosoft-Windows-Wcmsvc\n05.09.2026 08:28:57.789\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.789\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.789\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.789\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.791\t10002\tWCMSVC: Complete WCM Service Startup\tInformation\tMicrosoft-Windows-Wcmsvc/Operational\tMicrosoft-Windows-Wcmsvc\n05.09.2026 08:28:57.793\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.793\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.793\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.793\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.796\t5000\t\"TPM Manufacturer: Intel\nVersion: 2.0\nFirmware Version: 700.19.18.2682\nIs Ready: true\"\tInformation\tMicrosoft-Windows-HelloForBusiness/Operational\tMicrosoft-Windows-HelloForBusiness\n05.09.2026 08:28:57.831\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.831\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.838\t204\tStart of StartUSBVideoDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.838\t205\tStop of StartUSBVideoDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.838\t215\tStart of PowerIrpCompletion\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.838\t220\tPowerIrp_CheckingPLFRegistry\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.838\t216\tStop of PowerIrpCompletion\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.838\t218\tFilterIrp Completed\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.838\t218\tFilterIrp Completed\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.838\t230\tPowerIrp_PassiveWakeupCompleted\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.840\t50\tCamera DeviceMFT InitializeTransform, SymbolicLink: \\\\?\\USB#VID_5858&PID_1004&MI_00#6&55f168&0&0000#{e5323777-f976-4f5b-9b55-b94699c46e44}\\GLOBAL\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_DeviceMFT\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:28:57.843\t6009\tMicrosoft (R) Windows (R) 10.00. 26200  Multiprocessor Free.\tInformation\tSystem\tEventLog\n05.09.2026 08:28:57.844\t6005\tThe Event log service was started.\tInformation\tSystem\tEventLog\n05.09.2026 08:28:57.845\t6013\tThe system uptime is 10 seconds.\tInformation\tSystem\tEventLog\n05.09.2026 08:28:57.856\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.856\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.861\t51\tCamera DeviceMFT InitializeTransform, hr: 0x0\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_DeviceMFT\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:28:57.867\t222\tStart of RestoreDefaults\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.868\t223\tStop of RestoreDefaults\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.868\t202\tStart of PowerDownDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.868\t203\tStop of PowerDownDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.869\t206\tStart of StopUSBVideoDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.869\t207\tStop of StopUSBVideoDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.869\t215\tStart of PowerIrpCompletion\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.869\t216\tStop of PowerIrpCompletion\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.877\t200\tStart of PowerUpDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.877\t201\tStop of PowerUpDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.877\t217\tFilterIrp Pending\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.877\t204\tStart of StartUSBVideoDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.877\t205\tStop of StartUSBVideoDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.877\t215\tStart of PowerIrpCompletion\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.877\t220\tPowerIrp_CheckingPLFRegistry\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.877\t216\tStop of PowerIrpCompletion\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.878\t218\tFilterIrp Completed\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.878\t218\tFilterIrp Completed\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.878\t230\tPowerIrp_PassiveWakeupCompleted\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.879\t50\tCamera DeviceMFT InitializeTransform, SymbolicLink: \\\\?\\USB#VID_5858&PID_1004&MI_00#6&55f168&0&0000#{e5323777-f976-4f5b-9b55-b94699c46e44}\\GLOBAL\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_DeviceMFT\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:28:57.887\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.888\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.888\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.888\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.888\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.888\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.889\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.889\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.889\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.889\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.889\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.890\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.890\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.890\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.890\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.890\t51\tCamera DeviceMFT InitializeTransform, hr: 0x0\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_DeviceMFT\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:28:57.893\t222\tStart of RestoreDefaults\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.894\t223\tStop of RestoreDefaults\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.894\t202\tStart of PowerDownDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.894\t203\tStop of PowerDownDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.894\t206\tStart of StopUSBVideoDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.895\t207\tStop of StopUSBVideoDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.895\t215\tStart of PowerIrpCompletion\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.895\t216\tStop of PowerIrpCompletion\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.903\t62\tFrameServer FsmDeviceWatcher InternalUpdateSensorGroups Stop, AnyFailed: false\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:28:57.916\t267\tTouch/Touchpad Hardware Quality Assurance verification succeeded.\tInformation\tSystem\tWin32k\n05.09.2026 08:28:57.923\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.923\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.935\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.940\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.943\t180\tReceived Po AudioStandby request\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.946\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.948\t4000\t\"Starting computer boot policy processing for WORKGROUP\\HONOR-FRG-X$. \nActivity id: {e95cffa2-4e00-44b7-99d3-fff2833b3dc9}\"\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.948\t5340\tThe Group Policy processing mode is Foreground asynchronous.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.959\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.960\t5311\tThe loopback policy processing mode is \"No loopback mode\".\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.960\t4126\tGroup Policy receiving applicable GPOs from the domain controller.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.960\t5257\tSuccessfully completed downloading policies.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.960\t0\t\"VmSwitch Driver state\n\nState: Started Loading,\nFunction: DriverEntry\"\tInformation\t16\tMicrosoft-Windows-Hyper-V-VmSwitch\n05.09.2026 08:28:57.960\t277\tvmswitch.sys build 26100.amd64.ge_release_svc_prod1, debug false, official true, Aug  8 2026 09:35:10\tInformation\tSystem\tMicrosoft-Windows-Hyper-V-VmSwitch\n05.09.2026 08:28:57.961\t5126\tGroup Policy successfully got applicable GPOs from the domain controller.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.961\t5312\t\"List of applicable Group Policy objects: \n\nLocal Group Policy\n\"\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.961\t5313\t\"The following Group Policy objects were not applicable because they were filtered out : \n\n\u041e\u0442\u0441\u0443\u0442\u0441\u0442\u0432\u0443\u0435\u0442\"\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.962\t0\t\"ProtocolNic NetPnpEvent Begin\n\nnetPnpEvent: NetEventBindsComplete,\nnicName: ,\nnicFriendlyName: ,\nswitchName: ,\nswitchFriendlyName: \"\tInformation\t16\tMicrosoft-Windows-Hyper-V-VmSwitch\n05.09.2026 08:28:57.962\t0\t\"ProtocolNic NetPnpEvent End\n\nnetPnpEvent: NetEventBindsComplete,\nnicName: ,\nnicFriendlyName: ,\nswitchName: ,\nswitchFriendlyName: ,\ndelta (100 ns): 57,\nStatus: 0x0(NT=STATUS_SUCCESS)\"\tInformation\t16\tMicrosoft-Windows-Hyper-V-VmSwitch\n05.09.2026 08:28:57.963\t0\t\"ExtProtocol NetPnpEvent Begin\n\nnetPnpEvent: NetEventBindsComplete,\nswitchName: ,\nswitchFriendlyName: \"\tInformation\t16\tMicrosoft-Windows-Hyper-V-VmSwitch\n05.09.2026 08:28:57.963\t0\t\"ExtProtocol NetPnpEvent End\n\nnetPnpEvent: NetEventBindsComplete,\nswitchName: ,\nswitchFriendlyName: ,\ndelta (100 ns): 79,\nStatus: 0x0(NT=STATUS_SUCCESS)\"\tInformation\t16\tMicrosoft-Windows-Hyper-V-VmSwitch\n05.09.2026 08:28:57.963\t0\t\"VmSwitch Driver state\n\nState: Installed and Started.,\nFunction: DriverEntry,\ndelta (100 ns): 31357,\nStatus: 0x0(NT=STATUS_SUCCESS)\"\tInformation\t16\tMicrosoft-Windows-Hyper-V-VmSwitch\n05.09.2026 08:28:57.965\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.965\t5320\tChecking for Group Policy client extensions that are not part of the system.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.965\t5320\tService configuration update to standalone is not required and will be skipped.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.965\t5320\tFinished checking for non-system extensions.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.972\t8000\tCompleted computer boot policy processing for WORKGROUP\\HONOR-FRG-X$ in 0 seconds.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.973\t5117\tGroup policy session completed successfully.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.983\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.983\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.993\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.996\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.996\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.996\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.996\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.006\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.006\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.040\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:58.046\t112\tAttempted to reserve URL http://*:5357/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:58.046\t112\tAttempted to reserve URL http://+:80/Temporary_Listen_Addresses/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:58.046\t112\tAttempted to reserve URL https://*:5358/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:58.046\t112\tAttempted to reserve URL http://*:2869/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:58.046\t112\tAttempted to reserve URL https://+:5986/wsman/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:58.046\t112\tAttempted to reserve URL http://+:47001/wsman/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:58.046\t112\tAttempted to reserve URL http://+:5985/wsman/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:58.046\t112\tAttempted to reserve URL https://+:10245/WMPNSSv4/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:58.046\t112\tAttempted to reserve URL http://+:10243/WMPNSSv4/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:58.046\t112\tAttempted to reserve URL http://+:3387/rdp/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:58.046\t112\tAttempted to reserve URL http://+:80/0131501b-d67f-491b-9a40-c4bf27bcb4d4/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:58.046\t112\tAttempted to reserve URL https://+:443/C574AC30-5794-4AEE-B1BB-6651C5315029/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:58.046\t112\tAttempted to reserve URL http://+:80/116B50EB-ECE2-41ac-8429-9F9E963361B7/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:58.046\t112\tAttempted to reserve URL https://+:3392/rdp/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:58.046\t112\tAttempted to reserve URL https://+:443/sra_{BA195980-CD49-458b-9E23-C84EE0ADCD75}/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:58.046\t112\tAttempted to reserve URL http://+:10246/MDEServer/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:58.046\t112\tAttempted to reserve URL http://+:10247/apps/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:58.047\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.047\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.056\t10016\t\"The \u0434\u043b\u044f \u043a\u043e\u043d\u043a\u0440\u0435\u0442\u043d\u043e\u0433\u043e \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f permission settings do not grant \u041b\u043e\u043a\u0430\u043b\u044c\u043d\u043e \u0410\u043a\u0442\u0438\u0432\u0430\u0446\u0438\u044f permission for the COM Server application with CLSID \n{9EA82395-E31B-41CA-8DF7-EC1CEE7194DF}\n and APPID \n{2ED83BAA-B2FD-43B1-99BF-E6149C622692}\n to the user NT AUTHORITY\\NETWORK SERVICE SID (S-1-5-20) from address LocalHost (\u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c LRPC) running in the application container \u041d\u0435\u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e SID (\u041d\u0435\u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e). This security permission can be modified using the Component Services administrative tool.\"\tWarning\tSystem\tMicrosoft-Windows-DistributedCOM\n05.09.2026 08:28:58.065\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:58.078\t5033\tThe Windows Firewall Driver started successfully.\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.084\t30950\t\"Component capabilities: 0x2\nInternal patch number: 0x0\n\"\tInformation\tMicrosoft-Windows-SMBClient/Operational\tMicrosoft-Windows-SMBClient\n05.09.2026 08:28:58.086\t284\tREINDEX command has run; database indices are updated [Partition=2, ProcessId=900, Scope=File]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:28:58.087\t284\tREINDEX command has run; database indices are updated [Partition=2, ProcessId=900, Scope=PackageAppInstaller]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:28:58.089\t284\tREINDEX command has run; database indices are updated [Partition=2, ProcessId=900, Scope=PackageSourceUri]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:28:58.089\t284\tREINDEX command has run; database indices are updated [Partition=2, ProcessId=900, Scope=NULL]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:28:58.094\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:58.103\t1041\tPre-attestation health check detailed information: {\"Version\":2,\"HealthStatus\":\"Possibly attestable\",\"Required\":[{\"Field\":\"TpmPresent\",\"Value\":true,\"DesiredValue\":true},{\"Field\":\"TpmMeetsMinimumVersion\",\"Value\":true,\"DesiredValue\":true},{\"Field\":\"TpmIsResponsive\",\"Value\":true,\"DesiredValue\":true},{\"Field\":\"EkCertIsAvailable\",\"Value\":true,\"DesiredValue\":true},{\"Field\":\"TcgLogFound\",\"Value\":true,\"DesiredValue\":true}],\"Expected\":[{\"Field\":\"PcrsMatchTcgLog\",\"Value\":false,\"DesiredValue\":true,\"DiagnosticInfo\":{\"SoftwarePcrReplayHresult\":0,\"HardwarePcrReplayHresult\":0,\"BitMaskOfPcrMismatches\":1}}],\"Informational\":[{\"Field\":\"SecureBootEnabled\",\"ValueFromComputer\":true,\"ValueFromTcgLog\":true,\"DesiredValue\":true,\"TcgValueIsVerifiable\":true},{\"Field\":\"VirtualSecureMemory\",\"ValueFromComputer\":false,\"ValueFromTcgLog\":false,\"DesiredValue\":true,\"TcgValueIsVerifiable\":true},{\"Field\":\"SecureCorePCCompliant\",\"ValueFromComputer\":false,\"ValueFromTcgLog\":false,\"DesiredValue\":true,\"TcgValueIsVerifiable\":true},{\"Field\":\"MostRecentBootTcgLogFoundInFileSystem\",\"Value\":true,\"DesiredValue\":true},{\"Field\":\"CurrentTcgLogFoundInFileSystem\",\"Value\":true,\"DesiredValue\":true},{\"Field\":\"EkCertRsa2048IsAvailable\",\"Value\":true,\"DesiredValue\":true},{\"Field\":\"EkCertEccP256IsAvailable\",\"Value\":true,\"DesiredValue\":true},{\"Field\":\"EkCertEccP384IsAvailable\",\"Value\":true,\"DesiredValue\":true},{\"Field\":\"WindowsAikCertRsa2048IsAvailable\",\"Value\":true,\"DesiredValue\":true},{\"Field\":\"WindowsAikCertEccP256IsAvailable\",\"Value\":true,\"DesiredValue\":true},{\"Field\":\"WindowsAikCertEccP384IsAvailable\",\"Value\":true,\"DesiredValue\":true}]}\tInformation\tSystem\tMicrosoft-Windows-TPM-WMI\n05.09.2026 08:28:58.103\t1039\t\"Pre-attestation health checks confirm that the device meets most attestation criteria, but failing is still possible.\n Please see C:\\WINDOWS\\Logs\\MeasuredBoot\\0000000179-0000000000.json for detailed information on what checks were made.\"\tInformation\tSystem\tMicrosoft-Windows-TPM-WMI\n05.09.2026 08:28:58.112\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:58.116\t30810\t\"Added a TCP/IP transport interface.\n\nName: \u041f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435 \u043f\u043e \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u0439 \u0441\u0435\u0442\u0438\nInterfaceIndex: 0xF\n\nGuidance:\nA TCP/IP binding was added to the specified network adapter for the SMB client. The SMB client can now send and receive SMB traffic on this network adapter using TCP/IP. You should expect this event when a computer restarts or when a previously disabled network adaptor is re-enabled. No user action is required.\"\tInformation\tMicrosoft-Windows-SmbClient/Connectivity\tMicrosoft-Windows-SMBClient\n05.09.2026 08:28:58.116\t30810\t\"Added a TCP/IP transport interface.\n\nName: \u041f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435 \u043f\u043e \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u0439 \u0441\u0435\u0442\u0438\nInterfaceIndex: 0xF\n\nGuidance:\nA TCP/IP binding was added to the specified network adapter for the SMB client. The SMB client can now send and receive SMB traffic on this network adapter using TCP/IP. You should expect this event when a computer restarts or when a previously disabled network adaptor is re-enabled. No user action is required.\"\tInformation\tMicrosoft-Windows-SmbClient/Connectivity\tMicrosoft-Windows-SMBClient\n05.09.2026 08:28:58.116\t30810\t\"Added a TCP/IP transport interface.\n\nName: \u0421\u0435\u0442\u0435\u0432\u043e\u0435 \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435 Bluetooth\nInterfaceIndex: 0xC\n\nGuidance:\nA TCP/IP binding was added to the specified network adapter for the SMB client. The SMB client can now send and receive SMB traffic on this network adapter using TCP/IP. You should expect this event when a computer restarts or when a previously disabled network adaptor is re-enabled. No user action is required.\"\tInformation\tMicrosoft-Windows-SmbClient/Connectivity\tMicrosoft-Windows-SMBClient\n05.09.2026 08:28:58.133\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:58.148\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:58.154\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.154\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.156\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.156\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.163\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.163\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.164\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.164\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.164\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.164\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.166\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.166\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.174\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:58.180\t1900\tTDI mode enabled: true\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:28:58.181\t1080\t\"Component capabilities: 0x2\nInternal patch number: 0x0\n\"\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:28:58.184\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.184\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.185\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.185\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.207\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.207\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.225\t0\t\tInformation\tApplication\tRtkAudioUniversalService\n05.09.2026 08:28:58.234\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:58.238\t265\tCheckpoint has been performed\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:28:58.249\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.249\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.263\t245\tMaintenance has been performed\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:28:58.269\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:58.270\t2000\tCtap service started successfully.\t16\tMicrosoft-Windows-WebAuthN/Operational\tMicrosoft-Windows-WebAuthN\n05.09.2026 08:28:58.292\t5615\tWindows Management Instrumentation Service started sucessfully\tInformation\tApplication\tMicrosoft-Windows-WMI\n05.09.2026 08:28:58.295\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-20\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E4\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-544\n\tGroup Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u044b\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x12e0\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.296\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-20\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E4\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-551\n\tGroup Name:\t\t\u041e\u043f\u0435\u0440\u0430\u0442\u043e\u0440\u044b \u0430\u0440\u0445\u0438\u0432\u0430\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x12e0\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.304\t0\tIntel(R) WMI Registration Service started.\tInformation\tApplication\tWMIRegistrationService\n05.09.2026 08:28:58.309\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-544\n\tGroup Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u044b\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x64c\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.310\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-551\n\tGroup Name:\t\t\u041e\u043f\u0435\u0440\u0430\u0442\u043e\u0440\u044b \u0430\u0440\u0445\u0438\u0432\u0430\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x64c\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.329\t265\t1 predictions were fetched for transforms '' and PCRs 7,11. USN: 0, Matching PCRs: 1,2,3,4,5,6,7,8,9,10,11.\tInformation\tMicrosoft-Windows-PCRPF/PCRPF\tMicrosoft-Windows-PCRPF\n05.09.2026 08:28:58.361\t100\tDiagnostic module {15fba3b8-a37a-4f91-bdba-fbb98fe804bf} (%SystemRoot%\\system32\\diagperf.dll) detected a problem for scenario {2698178d-fdad-40ae-9d3c-1371703adc5b}, instance {f8b1fb61-72e8-4386-90e5-a13899de9cd1}, original activity ID {2698178d-fdad-40ae-9d3c-1371703adc5b}.\tInformation\tMicrosoft-Windows-Diagnosis-DPS/Operational\tMicrosoft-Windows-Diagnosis-DPS\n05.09.2026 08:28:58.361\t105\tDiagnostic module {15fba3b8-a37a-4f91-bdba-fbb98fe804bf} (%SystemRoot%\\system32\\diagperf.dll) started troubleshooting scenario {2698178d-fdad-40ae-9d3c-1371703adc5b}, instance {f8b1fb61-72e8-4386-90e5-a13899de9cd1}, original activity ID {2698178d-fdad-40ae-9d3c-1371703adc5b}.\tInformation\tMicrosoft-Windows-Diagnosis-DPS/Operational\tMicrosoft-Windows-Diagnosis-DPS\n05.09.2026 08:28:58.371\t1025\t\"One or more named pipes or shares have been marked for access by anonymous users.  This increases the security risk of the computer by allowing unauthenticated users to connect to this server.\n\nRegistry Key: HKLM\\System\\CurrentControlSet\\Services\\LanmanServer\\Parameters\nRegistry Values: NullSessionPipes, NullSessionShares\nDefault Value: Empty (or not present)\nCurrent Value: Non-empty\n\nGuidance:\n\nYou should expect this event when modifying the default values of NullSessionShares and NullSessionPipes. On a typical file server, these settings do not exist or do not contain values, which is the most secure configuration. By default, domain controllers populate the NullSessionShares entry with netlogon, samr, and lsarpc to allow legacy access methods.\"\tWarning\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:28:58.389\t3011\t\"The SMB server service created an endpoint with the following listener rule entry settings: \nTransport: \\Device\\NetbiosSmb\nPort: 445\nTransportType: SrvNetTransportTypeTcpip\nSrvInstances: Default, CSV, SBL, SR\n\nGuidance:\n\nYou should expect this event when assigning alternative SMB server listener ports and on any subsequent restarts of the SMB server service.\"\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:28:58.389\t1010\t\"Endpoint added.\n\nName: HONOR-FRG-X     \nDomain Name: WORKGROUP\nTransport Name: \\Device\\NetbiosSmb\nTransport Flags: 0x1\n\nGuidance:\n\nYou should expect this event when the server starts listening on an interface, such as during system restart or when enabling a network adaptor. No user action is required.\"\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:28:58.401\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.401\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.406\t1040\tReceived Mib notification type MibInitialNotification for interface 0\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:28:58.407\t1034\tSend RDMA Endpoint notification failure - DadState is different from IpDadStatePreferred for interface 15. Current DadState: 1.\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:28:58.407\t1034\tSend RDMA Endpoint notification failure - DadState is different from IpDadStatePreferred for interface 15. Current DadState: 3.\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:28:58.407\t1034\tSend RDMA Endpoint notification failure - DadState is different from IpDadStatePreferred for interface 12. Current DadState: 3.\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:28:58.407\t1040\tReceived Mib notification type MibInitialNotification for interface 0\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:28:58.407\t1034\tSend RDMA Endpoint notification failure - DadState is different from IpDadStatePreferred for interface 15. Current DadState: 1.\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:28:58.407\t1034\tSend RDMA Endpoint notification failure - DadState is different from IpDadStatePreferred for interface 15. Current DadState: 3.\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:28:58.407\t1034\tSend RDMA Endpoint notification failure - DadState is different from IpDadStatePreferred for interface 12. Current DadState: 3.\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:28:58.408\t1053\tRestored 0 of 0 server certificate mappings from persistent storage. Last error code: 0x0.\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:28:58.451\t0\tService started successfully.\tInformation\tApplication\tDSAUpdateService\n05.09.2026 08:28:58.463\t0\tService started successfully.\tInformation\tApplication\tDSAService\n05.09.2026 08:28:58.482\t5617\tWindows Management Instrumentation Service subsystems initialized successfully\tInformation\tApplication\tMicrosoft-Windows-WMI\n05.09.2026 08:28:58.507\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.507\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.508\t1002\tError 0x80070002 occurred while verifying known folder {352481e8-33be-4251-ba85-6007caedcf9d} with path 'C:\\WINDOWS\\system32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\INetCache'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:28:58.526\t1003\tDSAService.dll:7:DSAClientCore.Controllers.Computer.SettingsController|SetDsaDirectoryFallback|()|DsaDirectoryFallback changed.\tInformation\tApplication\tDSAService\n05.09.2026 08:28:58.544\t1003\tDSAService.dll:7:Intel.DSA.CommonCore.Controllers.Computer.FileSystemSafetyController|AreAdministratorsPermissionsValid|()|Downloads directory rules count is incorrect\tError\tApplication\tDSAService\n05.09.2026 08:28:58.656\t2003\tWindows 10 Pro6.3262002009windows-11-25h2-6426.2.0.7DSACommon.dllIntel.DSA.CommonCore.Controllers.Computer.FileSystemSafetyControllerCreateOrVerifyDirectoryCreateOrVerifyUnsafeTreeExceptionDownloads\tInformation\tApplication\tDSAService\n05.09.2026 08:28:58.658\t1003\tDSAService.dll:7:Intel.DSA.CommonCore.Controllers.Computer.FileSystemSafetyController|CreateOrVerifyDirectory|()|Downloads directory is invalid\tError\tApplication\tDSAService\n05.09.2026 08:28:58.660\t1003\tDSAService.dll:7:Intel.DSA.Service.Service|OnStartTask|()|Create DSA directory failed\tError\tApplication\tDSAService\n05.09.2026 08:28:58.666\t1003\tDSAService.dll:7:DSAClientCore.Controllers.Computer.SettingsController|SetDsaDirectoryFallback|()|DsaDirectoryFallback changed.\tInformation\tApplication\tDSAService\n05.09.2026 08:28:58.668\t1003\tDSAService.dll:7:DSAClientCore.Controllers.Computer.SettingsController|SetDownloadsDirectoryFallback|()|DownloadsDirectoryFallback changed.\tInformation\tApplication\tDSAService\n05.09.2026 08:28:58.669\t1003\tDSAService.dll:7:Intel.DSA.Service.Service|OnStartTask|()|Initializing logging\tInformation\tApplication\tDSAService\n05.09.2026 08:28:58.719\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x388\n\tProcess Name:\t\tC:\\Windows\\System32\\LogonUI.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.768\t265\t1 predictions were fetched for transforms '' and PCRs 7,11. USN: 0, Matching PCRs: 1,2,3,4,5,6,7,8,9,10,11.\tInformation\tMicrosoft-Windows-PCRPF/PCRPF\tMicrosoft-Windows-PCRPF\n05.09.2026 08:28:58.874\t1\tAuthentication started.\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:28:58.885\t12289\t\"DPAPI found credential key.\n\n \tCredential Key Identifier:\t0x06D97C618B44CF98843820BCDDCC91F4B12D43F5A34189AE108C7BC82636830E\n \tUser Name:\tadmin\n \tUser Sid:\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\"\tInformation\tMicrosoft-Windows-Crypto-DPAPI/Operational\tMicrosoft-Windows-Crypto-DPAPI\n05.09.2026 08:28:58.886\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x6c4\n\tProcess Name:\t\tC:\\Windows\\System32\\lsass.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.890\t12289\t\"DPAPI found credential key.\n\n \tCredential Key Identifier:\t0x06D97C618B44CF98843820BCDDCC91F4B12D43F5A34189AE108C7BC82636830E\n \tUser Name:\tadmin\n \tUser Sid:\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\"\tInformation\tMicrosoft-Windows-Crypto-DPAPI/Operational\tMicrosoft-Windows-Crypto-DPAPI\n05.09.2026 08:28:58.890\t12289\t\"DPAPI found credential key.\n\n \tCredential Key Identifier:\t0x06D97C618B44CF98843820BCDDCC91F4B12D43F5A34189AE108C7BC82636830E\n \tUser Name:\tadmin\n \tUser Sid:\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\"\tInformation\tMicrosoft-Windows-Crypto-DPAPI/Operational\tMicrosoft-Windows-Crypto-DPAPI\n05.09.2026 08:28:58.900\t5007\t\"\u0410\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043d\u0430\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430 Microsoft Defender Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.\n \tOld value: Default\\IsServiceRunning = 0x0\n \tNew value: HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\IsServiceRunning = 0x1\"\tInformation\tMicrosoft-Windows-Windows Defender/Operational\tMicrosoft-Windows-Windows Defender\n05.09.2026 08:28:58.902\t5007\t\"\u0410\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043d\u0430\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430 Microsoft Defender Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.\n \tOld value: HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\Diagnostics\\InitializingComponentProgress = InitializeMiscConfigLibrary\n \tNew value: HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\Diagnostics\\InitializingComponentProgress = PostPlatformUpdate\"\tInformation\tMicrosoft-Windows-Windows Defender/Operational\tMicrosoft-Windows-Windows Defender\n05.09.2026 08:28:58.909\t4648\t\"A logon was attempted using explicit credentials.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nAccount Whose Credentials Were Used:\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nTarget Server:\n\tTarget Server Name:\tlocalhost\n\tAdditional Information:\tlocalhost\n\nProcess Information:\n\tProcess ID:\t\t0xb88\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\n\nNetwork Information:\n\tNetwork Address:\t127.0.0.1\n\tPort:\t\t\t0\n\nThis event is generated when a process attempts to log on an account by explicitly specifying that account\u2019s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.909\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t2\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tLinked Logon ID:\t\t0x5F77B\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0xb88\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\n\nNetwork Information:\n\tWorkstation Name:\tHONOR-FRG-X\n\tSource Network Address:\t127.0.0.1\n\tSource Port:\t\t0\n\nDetailed Authentication Information:\n\tLogon Process:\t\tUser32 \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.909\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t2\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tNo\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tLinked Logon ID:\t\t0x5F489\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0xb88\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\n\nNetwork Information:\n\tWorkstation Name:\tHONOR-FRG-X\n\tSource Network Address:\t127.0.0.1\n\tSource Port:\t\t0\n\nDetailed Authentication Information:\n\tLogon Process:\t\tUser32 \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.909\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\nPrivileges:\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.913\t2\tAuthentication stopped. Result 0\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:28:58.924\t41\t\"Begin session arbitration:\n\nUser: HONOR-FRG-X\\admin\nSession ID: 1\"\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:28:58.925\t42\t\"End session arbitration:\n\nUser: HONOR-FRG-X\\admin\nSession ID: 1\"\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:28:58.926\t7001\tUser Logon Notification for Customer Experience Improvement Program\tInformation\tSystem\tMicrosoft-Windows-Winlogon\n05.09.2026 08:28:58.935\t6003\tThe winlogon notification subscriber  was unavailable to handle a critical notification event.\tInformation\tApplication\tMicrosoft-Windows-Winlogon\n05.09.2026 08:28:58.938\t811\tThe winlogon notification subscriber  began handling the notification event (2).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:28:58.938\t1\tRecieved user logon notification on session 1.\tInformation\tMicrosoft-Windows-User Profile Service/Operational\tMicrosoft-Windows-User Profiles Service\n05.09.2026 08:28:58.951\t3\tInstance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, WMIProv, 0) could not be created. Error: \"Cannot create a file when that file already exists.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:28:58.954\t0\tService started successfully.\tInformation\tApplication\tIntel Graphics Software Service\n05.09.2026 08:28:58.964\t5\tRegistry file C:\\Users\\admin\\ntuser.dat is loaded at HKU\\S-1-5-21-3712849175-2219398513-4278588552-1006.\tInformation\tMicrosoft-Windows-User Profile Service/Operational\tMicrosoft-Windows-User Profiles Service\n05.09.2026 08:28:58.984\t5\tRegistry file C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\\\UsrClass.dat is loaded at HKU\\S-1-5-21-3712849175-2219398513-4278588552-1006_Classes.\tInformation\tMicrosoft-Windows-User Profile Service/Operational\tMicrosoft-Windows-User Profiles Service\n05.09.2026 08:28:58.987\t67\t\"Logon type: Regular \nLocal profile location: C:\\Users\\admin \nProfile type: Regular\"\tInformation\tMicrosoft-Windows-User Profile Service/Operational\tMicrosoft-Windows-User Profiles Service\n05.09.2026 08:28:59.001\t265\t1 predictions were fetched for transforms '' and PCRs 7,11. USN: 0, Matching PCRs: 1,2,3,4,5,6,7,8,9,10,11.\tInformation\tMicrosoft-Windows-PCRPF/PCRPF\tMicrosoft-Windows-PCRPF\n05.09.2026 08:28:59.007\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-544\n\tGroup Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u044b\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0xa54\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:59.014\t2\tFinished processing user logon notification on session 1.\tInformation\tMicrosoft-Windows-User Profile Service/Operational\tMicrosoft-Windows-User Profiles Service\n05.09.2026 08:28:59.014\t812\tThe winlogon notification subscriber  finished handling the notification event (2).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:28:59.014\t811\tThe winlogon notification subscriber  began handling the notification event (2).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:28:59.014\t5324\tGroup Policy received the notification Logon from Winlogon for session 1.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:59.015\t5351\tGroup policy session returned to winlogon.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:59.015\t812\tThe winlogon notification subscriber  finished handling the notification event (2).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:28:59.015\t811\tThe winlogon notification subscriber  began handling the notification event (2).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:28:59.016\t4117\tGroup Policy Session started.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:59.016\t4001\t\"Starting user logon Policy processing for HONOR-FRG-X\\admin. \nActivity id: {c39b0a24-49ad-4cd8-8b22-433b5a87bee2}\"\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:59.017\t5340\tThe Group Policy processing mode is Foreground asynchronous.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:59.019\t178\tGlobal user presence detected\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:59.021\t179\tReceived session display notification\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:59.025\t819\tThe following packages will be installed: . The following packages will be removed: \tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:28:59.025\t5311\tThe loopback policy processing mode is \"No loopback mode\".\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:59.025\t4126\tGroup Policy receiving applicable GPOs from the domain controller.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:59.025\t5257\tSuccessfully completed downloading policies.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:59.027\t5126\tGroup Policy successfully got applicable GPOs from the domain controller.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:59.028\t5312\t\"List of applicable Group Policy objects: \n\n\u041e\u0442\u0441\u0443\u0442\u0441\u0442\u0432\u0443\u0435\u0442\"\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:59.028\t5313\t\"The following Group Policy objects were not applicable because they were filtered out : \n\nLocal Group Policy\n\t\u041d\u0435 \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u0442\u0441\u044f (\u043f\u0443\u0441\u0442\u043e)\n\"\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:59.030\t5320\tChecking for Group Policy client extensions that are not part of the system.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:59.030\t5320\tService configuration update to standalone is not required and will be skipped.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:59.030\t5320\tFinished checking for non-system extensions.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:59.033\t8001\tCompleted user logon policy processing for HONOR-FRG-X\\admin in 0 seconds.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:59.033\t5117\tGroup policy session completed successfully.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:59.123\t1001\tThe Windows Resource Exhaustion Detector started.\tInformation\tMicrosoft-Windows-Resource-Exhaustion-Detector/Operational\tMicrosoft-Windows-Resource-Exhaustion-Detector\n05.09.2026 08:28:59.192\t265\t1 predictions were fetched for transforms '' and PCRs 7,11. USN: 0, Matching PCRs: 1,2,3,4,5,6,7,8,9,10,11.\tInformation\tMicrosoft-Windows-PCRPF/PCRPF\tMicrosoft-Windows-PCRPF\n05.09.2026 08:28:59.344\t111\tCreate URL group 0xFE00000C20000001. Status 0x0. Process Id 0x1438 Executable path \\Device\\HarddiskVolume3\\Program Files (x86)\\Intel\\Driver and Support Assistant\\x86\\DSAService.exe, User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:59.344\t113\tAttempted to add URL (http://127.0.0.1:28390:127.0.0.1/) to URL group (0xFE00000C20000001). Status: 0x0. Process Id 0x1438 Executable path \\Device\\HarddiskVolume3\\Program Files (x86)\\Intel\\Driver and Support Assistant\\x86\\DSAService.exe, User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:59.346\t265\t1 predictions were fetched for transforms '' and PCRs 7,11. USN: 0, Matching PCRs: 1,2,3,4,5,6,7,8,9,10,11.\tInformation\tMicrosoft-Windows-PCRPF/PCRPF\tMicrosoft-Windows-PCRPF\n05.09.2026 08:28:59.347\t111\tCreate URL group 0xFC00000C20000001. Status 0x0. Process Id 0x1438 Executable path \\Device\\HarddiskVolume3\\Program Files (x86)\\Intel\\Driver and Support Assistant\\x86\\DSAService.exe, User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:59.347\t113\tAttempted to add URL (http://127.0.0.1:28385:127.0.0.1/intel/) to URL group (0xFC00000C20000001). Status: 0x0. Process Id 0x1438 Executable path \\Device\\HarddiskVolume3\\Program Files (x86)\\Intel\\Driver and Support Assistant\\x86\\DSAService.exe, User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:59.367\t1002\tError 0x80070002 occurred while verifying known folder {352481e8-33be-4251-ba85-6007caedcf9d} with path 'C:\\WINDOWS\\system32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\INetCache'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:28:59.496\t265\t1 predictions were fetched for transforms '' and PCRs 7,11. USN: 0, Matching PCRs: 1,2,3,4,5,6,7,8,9,10,11.\tInformation\tMicrosoft-Windows-PCRPF/PCRPF\tMicrosoft-Windows-PCRPF\n05.09.2026 08:28:59.664\t142\t\"Summary of disk space usage, since last event:\n\n           Available space was between 68.43 GB and 68.66 GB\n           Change in available space: 230.72 MB\n           \n           Available clusters were between: 17937337 and 17996401\n           Reserved clusters were between: 57815 and 57815\n           Txf abort reserved clusters were between: 1024 and 1024\n           \n           Elapsed seconds: 0\n           \n           Pagefile size: 0 Bytes\n           Volume size: 200.07 GB\n           Bytes per cluster: 4096\n           \n           Volume guid: {5285d7ae-0000-0000-007e-000000000000}\n           Volume name: E:\n           Is boot volume: false\n           \n           Cached runs miss counts:\n               For MFT: 0\n               For MFT zone: 0\n               Everything else: 0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:59.672\t142\t\"Summary of disk space usage, since last event:\n\n           Available space was between 2.77 GB and 2.79 GB\n           Change in available space: 17.85 MB\n           \n           Available clusters were between: 725251 and 729820\n           Reserved clusters were between: 3532 and 3532\n           Txf abort reserved clusters were between: 1024 and 1024\n           \n           Elapsed seconds: 0\n           \n           Pagefile size: 0 Bytes\n           Volume size: 653.32 GB\n           Bytes per cluster: 4096\n           \n           Volume guid: {5285d7ae-0000-0000-0000-300432000000}\n           Volume name: F:\n           Is boot volume: false\n           \n           Cached runs miss counts:\n               For MFT: 0\n               For MFT zone: 2\n               Everything else: 0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:59.698\t142\t\"Summary of disk space usage, since last event:\n\n           Available space was between 5.10 GB and 5.12 GB\n           Change in available space: 21.26 MB\n           \n           Available clusters were between: 1336183 and 1341624\n           Reserved clusters were between: 4400 and 4400\n           Txf abort reserved clusters were between: 1024 and 1024\n           \n           Elapsed seconds: 0\n           \n           Pagefile size: 0 Bytes\n           Volume size: 78.13 GB\n           Bytes per cluster: 4096\n           \n           Volume guid: {5285d7ae-0000-0000-0000-a058d5000000}\n           Volume name: G:\n           Is boot volume: false\n           \n           Cached runs miss counts:\n               For MFT: 0\n               For MFT zone: 0\n               Everything else: 0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:59.701\t9\t\"NTFS scanned entire volume bitmap.\n\n           Volume correlation Id: {5285d7ae-0000-0000-007e-000000000000}\n           Volume name: E:\n           Volume label: HDD Seagate 1TB Backup+ S\n\n           Device name: \\Device\\HarddiskVolume8\n           Device GUID: {f721584f-c93a-4df4-f37c-1fcee53cc736}\n           Device manufacturer: Seagate \n           Device model: Backup+ SL      \n           Device revision: 0409\n           Device serial number: NA5161RS\n           Bus type: USB\n           Native NVMe: false\n\n           Adapter serial number: \n\n           Duration (micro seconds): 7529\n           InputFlags: 0x10\n           Reason: Proactive background scan to repopulate cached runs\n           Flags: 0x10\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:59.701\t10\t\"NTFS cached runs statistics.\n\n           Volume correlation Id: {5285d7ae-0000-0000-007e-000000000000}\n           Volume name: E:\n           Volume label: HDD Seagate 1TB Backup+ S\n\n           Device name: \\Device\\HarddiskVolume8\n           Device GUID: {f721584f-c93a-4df4-f37c-1fcee53cc736}\n           Device manufacturer: Seagate \n           Device model: Backup+ SL      \n           Device revision: 0409\n           Device serial number: NA5161RS\n           Bus type: USB\n           Native NVMe: false\n\n           Adapter serial number: \n\n           Media type: Hard disk\n           Runs cached: 162\n           Longest run cached: 23.86 GB\n           Most populated bin Count: 16\n           Most populated bin's minimum length: 992.01 MB\n           Most populated bin's maximum length: -\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:59.701\t9\t\"NTFS scanned entire volume bitmap.\n\n           Volume correlation Id: {5285d7ae-0000-0000-0000-300432000000}\n           Volume name: F:\n           Volume label: HDD Seagate 1TB Backup+ S\n\n           Device name: \\Device\\HarddiskVolume9\n           Device GUID: {f721584f-c93a-4df4-f37c-1fcee53cc736}\n           Device manufacturer: Seagate \n           Device model: Backup+ SL      \n           Device revision: 0409\n           Device serial number: NA5161RS\n           Bus type: USB\n           Native NVMe: false\n\n           Adapter serial number: \n\n           Duration (micro seconds): 25547\n           InputFlags: 0x10\n           Reason: Proactive background scan to repopulate cached runs\n           Flags: 0x10\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:59.701\t10\t\"NTFS cached runs statistics.\n\n           Volume correlation Id: {5285d7ae-0000-0000-0000-300432000000}\n           Volume name: F:\n           Volume label: HDD Seagate 1TB Backup+ S\n\n           Device name: \\Device\\HarddiskVolume9\n           Device GUID: {f721584f-c93a-4df4-f37c-1fcee53cc736}\n           Device manufacturer: Seagate \n           Device model: Backup+ SL      \n           Device revision: 0409\n           Device serial number: NA5161RS\n           Bus type: USB\n           Native NVMe: false\n\n           Adapter serial number: \n\n           Media type: Hard disk\n           Runs cached: 1037\n           Longest run cached: 37.35 MB\n           Most populated bin Count: 38\n           Most populated bin's minimum length: 8 KB\n           Most populated bin's maximum length: 8 KB\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:59.701\t9\t\"NTFS scanned entire volume bitmap.\n\n           Volume correlation Id: {5285d7ae-0000-0000-0000-a058d5000000}\n           Volume name: G:\n           Volume label: HDD Seagate 1TB Backup+ S\n\n           Device name: \\Device\\HarddiskVolume10\n           Device GUID: {f721584f-c93a-4df4-f37c-1fcee53cc736}\n           Device manufacturer: Seagate \n           Device model: Backup+ SL      \n           Device revision: 0409\n           Device serial number: NA5161RS\n           Bus type: USB\n           Native NVMe: false\n\n           Adapter serial number: \n\n           Duration (micro seconds): 2971\n           InputFlags: 0x10\n           Reason: Proactive background scan to repopulate cached runs\n           Flags: 0x10\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:59.701\t10\t\"NTFS cached runs statistics.\n\n           Volume correlation Id: {5285d7ae-0000-0000-0000-a058d5000000}\n           Volume name: G:\n           Volume label: HDD Seagate 1TB Backup+ S\n\n           Device name: \\Device\\HarddiskVolume10\n           Device GUID: {f721584f-c93a-4df4-f37c-1fcee53cc736}\n           Device manufacturer: Seagate \n           Device model: Backup+ SL      \n           Device revision: 0409\n           Device serial number: NA5161RS\n           Bus type: USB\n           Native NVMe: false\n\n           Adapter serial number: \n\n           Media type: Hard disk\n           Runs cached: 334\n           Longest run cached: 5.09 GB\n           Most populated bin Count: 188\n           Most populated bin's minimum length: 0 Bytes\n           Most populated bin's maximum length: 4 KB\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:29:00.078\t2003\tWindows 10 Pro6.3262002009windows-11-25h2-6426.2.0.7DSACommon.dllDSAClientCore.Controllers.Computer.DeviceControllerS:GD:EnumerateDevicesFileNotFoundExceptionCould not load file or assembly 'C:\\Program Files (x86)\\Intel\\Driver and Support Assistant\\x86\\DS...\tInformation\tApplication\tDSAService\n05.09.2026 08:29:00.078\t2003\tWindows 10 Pro6.3262002009windows-11-25h2-6426.2.0.7DSACommon.dllDSAClientCore.Controllers.Computer.DeviceControllerS:GSD:EnumerateDevicesFileNotFoundExceptionCould not load file or assembly 'C:\\Program Files (x86)\\Intel\\Driver and Support Assistant\\x86\\DS...\tInformation\tApplication\tDSAService\n05.09.2026 08:29:01.188\t269\tSRCache successfully initialized [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:29:01.202\t287\tStateRepository lifecycle transition to Running [ProcessId=900, ThreadId=2256] [ElapsedMS: RegisterService=0, StateRepository=0 AccessControl=0 Upgrade=643 Cache=2903 Module=0 CoRegisterServerShutdown=0 RegisterDisconnectableContext=16 RPC=0\tInformation\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:29:01.203\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.203\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.204\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.204\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.204\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.204\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.227\t100\tError 0x15: misuse at line 185353 of [737ae4a347]\tError\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:29:01.229\t939\tAppxsvc lifecycle transition to Starting (Checkpoint=2)\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:01.232\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.232\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.235\t8000\t\"Process Name: C:\\WINDOWS\\system32\\services.exe\nModule Name: C:\\WINDOWS\\SYSTEM32\\licensemanagerapi.dll\nBuild: 26100.1.amd64fre.ge_release.240331-1435\n\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:01.235\t940\tAppxsvc lifecycle transition to Running (Checkpoint=4)\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:01.236\t8001\t\"canDisableApps value is 0\nFunction: InitStoreAppsAreDisabled\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (195)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:01.237\t8001\t\"Skipping license manager: PFN SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:01.240\t231\tRepositoryManagerServerUpgrade with options: 0x1\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:29:01.245\t263\tWDDM graphics mode is enabled\tInformation\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager/Operational\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager\n05.09.2026 08:29:01.254\t20523\tConnection from listener RDP-Tcp will have terminal class of {5828227c-20cf-4408-b73f-73ab70b8849f}\tInformation\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager/Operational\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager\n05.09.2026 08:29:01.263\t100\tClipSVC service is starting.  Caller: \tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 08:29:01.268\t21\t\"Remote Desktop Services: Session logon succeeded:\n\nUser: HONOR-FRG-X\\admin\nSession ID: 1\nSource Network Address: \u041b\u041e\u041a\u0410\u041b\u042c\u041d\u042b\u0415\"\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:29:01.269\t812\tThe winlogon notification subscriber  finished handling the notification event (2).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:29:01.271\t811\tThe winlogon notification subscriber  began handling the notification event (2).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:29:01.271\t1003\t\"CDE reported a state change \n\n State: Connected. Service is running. \n\n Name: Wlansvc.\"\tInformation\tMicrosoft-Windows-Wcmsvc/Operational\tMicrosoft-Windows-Wcmsvc\n05.09.2026 08:29:01.274\t812\tThe winlogon notification subscriber  finished handling the notification event (2).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:29:01.275\t101\tClipSVC service is running.  Version 10.0.26100.9168\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 08:29:01.281\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.281\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.309\t603\tStarted deployment DeStage operation on a package with main parameter MdOdrMcpFilterPackage_1.0.0.0_neutral__cw5n1h2txyewy and Options RemoveForAllUsers and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:01.309\t70\tThe listener listens with display driver rdpudd.dll available.\tInformation\tMicrosoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational\tMicrosoft-Windows-RemoteDesktopServices-RdpCoreTS\n05.09.2026 08:29:01.312\t210\tCreated Desktop AppX container {245CDABB-A8C9-11F1-B7FF-289200F24A99} for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:01.312\t211\tAdded process 7712 to Desktop AppX container 245cdabb-a8c9-11f1-b7ff-289200f24a99 for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:01.315\t129\tThe server is using TCP to bind to port 15629.\tInformation\tMicrosoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational\tMicrosoft-Windows-RemoteDesktopServices-RdpCoreTS\n05.09.2026 08:29:01.316\t129\tThe server is using TCP to bind to port 15629.\tInformation\tMicrosoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational\tMicrosoft-Windows-RemoteDesktopServices-RdpCoreTS\n05.09.2026 08:29:01.318\t30810\t\"Added a TCP/IP transport interface.\n\nName: \u0421\u0435\u0442\u0435\u0432\u043e\u0435 \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435 Bluetooth\nInterfaceIndex: 0xC\n\nGuidance:\nA TCP/IP binding was added to the specified network adapter for the SMB client. The SMB client can now send and receive SMB traffic on this network adapter using TCP/IP. You should expect this event when a computer restarts or when a previously disabled network adaptor is re-enabled. No user action is required.\"\tInformation\tMicrosoft-Windows-SmbClient/Connectivity\tMicrosoft-Windows-SMBClient\n05.09.2026 08:29:01.318\t1040\tReceived Mib notification type MibAddInstance for interface 12\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:29:01.318\t1034\tSend RDMA Endpoint notification failure - DadState is different from IpDadStatePreferred for interface 12. Current DadState: 1.\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:29:01.318\t129\tThe server is using UDP to bind to port 15629.\tInformation\tMicrosoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational\tMicrosoft-Windows-RemoteDesktopServices-RdpCoreTS\n05.09.2026 08:29:01.319\t129\tThe server is using UDP to bind to port 15629.\tInformation\tMicrosoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational\tMicrosoft-Windows-RemoteDesktopServices-RdpCoreTS\n05.09.2026 08:29:01.320\t258\tListener RDP-Tcp has started listening\tInformation\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager/Operational\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager\n05.09.2026 08:29:01.324\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.324\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.327\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 7480) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffc2f207243, module offset: 0x17243, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x17bfbe7d940, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:29:01.327\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 7480) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffc2f1ffda9, module offset: 0xfda9, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x17bfbe72540, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:29:01.327\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 7480) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffc2f2090c3, module offset: 0x190c3, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x17bfbe72549, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:29:01.327\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 7480) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffc2f2006ff, module offset: 0x106ff, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x17bfbe72568, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:29:01.328\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 7480) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffc2f1f89fd, module offset: 0x89fd, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x17bfbe72560, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:29:01.338\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_1.rslc for Remove Operation on Package MdOdrMcpFilterPackage_1.0.0.0_neutral__cw5n1h2txyewy.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:01.341\t607\tDeployment Remove operation on package MdOdrMcpFilterPackage_1.0.0.0_neutral__cw5n1h2txyewy has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:01.359\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.359\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.378\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -s CertPropSvc( #0x0/0x8392 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:29:01.379\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -s CertPropSvc( #0x0/0x8392 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:29:01.379\t6000\tThe winlogon notification subscriber  was unavailable to handle a notification event.\tInformation\tApplication\tMicrosoft-Windows-Winlogon\n05.09.2026 08:29:01.381\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -s CertPropSvc( #0x0/0x8392 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:29:01.394\t221\tANALYZE command has run; database statistics are updated [Partition=1, ProcessId=3720, Scope=(database)]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:29:01.396\t811\tThe winlogon notification subscriber  began handling the notification event (12).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:29:01.396\t5324\tGroup Policy received the notification StartShell from Winlogon for session 1.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:29:01.397\t6339\tGroup Policy Winlogon Start Shell handling completed.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:29:01.397\t812\tThe winlogon notification subscriber  finished handling the notification event (12).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:29:01.397\t811\tThe winlogon notification subscriber  began handling the notification event (12).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:29:01.398\t812\tThe winlogon notification subscriber  finished handling the notification event (12).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:29:01.398\t811\tThe winlogon notification subscriber  began handling the notification event (12).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:29:01.399\t22\t\"Remote Desktop Services: Shell start notification received:\n\nUser: HONOR-FRG-X\\admin\nSession ID: 1\nSource Network Address: \u041b\u041e\u041a\u0410\u041b\u042c\u041d\u042b\u0415\"\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:29:01.399\t812\tThe winlogon notification subscriber  finished handling the notification event (12).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:29:01.407\t263\tWDDM graphics mode is enabled\tInformation\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager/Operational\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager\n05.09.2026 08:29:01.407\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.407\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.409\t50\tThe service has been started to the following state: Shutdown.\tInformation\tMicrosoft-Windows-UniversalTelemetryClient/Operational\tMicrosoft-Windows-UniversalTelemetryClient\n05.09.2026 08:29:01.418\t1136\tRD Session Host Server role is not installed.\tInformation\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager/Operational\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager\n05.09.2026 08:29:01.419\t263\tWDDM graphics mode is enabled\tInformation\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager/Operational\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager\n05.09.2026 08:29:01.425\t4000\t\"WLAN AutoConfig service has successfully started.\n\"\tInformation\tSystem\tMicrosoft-Windows-WLAN-AutoConfig\n05.09.2026 08:29:01.427\t263\tWDDM graphics mode is enabled\tInformation\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager/Operational\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager\n05.09.2026 08:29:01.428\t221\tANALYZE command has run; database statistics are updated [Partition=2, ProcessId=3720, Scope=(database)]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:29:01.430\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:29:01.431\t400\tDeployment DeStage operation with target volume C: on Package MdOdrMcpFilterPackage_1.0.0.0_neutral__cw5n1h2txyewy from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:01.434\t1009\t\"CDE reported an L2 adapter arrival \n\n Interface: {449f824d-2856-4717-a3a7-cf59faac817a} \n\n Type: Wlan\"\tInformation\tMicrosoft-Windows-Wcmsvc/Operational\tMicrosoft-Windows-Wcmsvc\n05.09.2026 08:29:01.434\t263\tWDDM graphics mode is enabled\tInformation\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager/Operational\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager\n05.09.2026 08:29:01.438\t1015\t\"Interface Token Applied\n\nInterface: {449f824d-2856-4717-a3a7-cf59faac817a}\nMedia Type: Wlan\nManual enabled: true\nAuto enabled: true\"\tInformation\tMicrosoft-Windows-Wcmsvc/Operational\tMicrosoft-Windows-Wcmsvc\n05.09.2026 08:29:01.441\t20524\tSupplemental Kerberos credentials are not configured\tInformation\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager/Operational\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager\n05.09.2026 08:29:01.444\t263\tWDDM graphics mode is enabled\tInformation\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager/Operational\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager\n05.09.2026 08:29:01.444\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:29:01.444\t18\tThis event triggers the Trusted Platform Module (TPM) provisioning/status check to run.\tInformation\tSystem\tTPM\n05.09.2026 08:29:01.492\t40961\tPowerShell console is starting up\tInformation\tMicrosoft-Windows-PowerShell/Operational\tMicrosoft-Windows-PowerShell\n05.09.2026 08:29:01.504\t1006\t\"A Terminal Services session change was processed. \n\n Reason: A user has logged on to the session\"\tInformation\tMicrosoft-Windows-Wcmsvc/Operational\tMicrosoft-Windows-Wcmsvc\n05.09.2026 08:29:01.521\t2100\t\"Ctap command started.\n\nTransactionId: {ec5295cc-66be-4c4e-b2bb-2a8769b4eb95}\nFlags: 0x0\nTimeoutMilliseconds: 0\nTicket: \nRequest: 0xA967636F6D6D616E640B65666C616773006774696D656F7574006D7472616E73616374696F6E496450CC9552ECBE664E4CB2BB2A8769B4EB957566696C7465724879627269645472616E73706F7274F4782061757468656E74696361746F72496E666F4C6F676F526571756573745479706500781F706C7567696E4175746F66696C6C5363656E6172696F537570706F72746564F46F75765472616E73616374696F6E4964500000000000000000000000000000000071746869726450617274795061796D656E74F4\"\tInformation\tMicrosoft-Windows-WebAuthN/Operational\tMicrosoft-Windows-WebAuthN\n05.09.2026 08:29:01.529\t10001\t\"WLAN Extensibility Module has successfully started.\n\nModule Path: C:\\WINDOWS\\system32\\IntelIHVRouter14.dll\n\"\tInformation\tSystem\tMicrosoft-Windows-WLAN-AutoConfig\n05.09.2026 08:29:01.546\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.546\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.650\t900\t\"The Software Protection service is starting.\nParameters:TriggerStarted:6\"\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 08:29:01.656\t5\tSecure Trustlet NULL Id 0 and Pid 0 started with status STATUS_SUCCESS.\tInformation\tSystem\tMicrosoft-Windows-IsolatedUserMode\n05.09.2026 08:29:01.657\t1\tSecure Trustlet \\??\\C:\\WINDOWS\\System32\\NgcIso.exe Id 6 and Pid 9244 started with status STATUS_SUCCESS.\tInformation\tSystem\tMicrosoft-Windows-IsolatedUserMode\n05.09.2026 08:29:01.672\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.672\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.676\t53504\tWindows PowerShell has started an IPC listening thread on process: 8404 in AppDomain: DefaultAppDomain.\tInformation\tMicrosoft-Windows-PowerShell/Operational\tMicrosoft-Windows-PowerShell\n05.09.2026 08:29:01.698\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.698\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.744\t10016\t\"The \u0434\u043b\u044f \u043a\u043e\u043d\u043a\u0440\u0435\u0442\u043d\u043e\u0433\u043e \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f permission settings do not grant \u041b\u043e\u043a\u0430\u043b\u044c\u043d\u043e \u0410\u043a\u0442\u0438\u0432\u0430\u0446\u0438\u044f permission for the COM Server application with CLSID \n{00000000-0000-0000-0000-000000000000}\n and APPID \n{4839DDB7-58C2-48F5-8283-E1D1807D0D7D}\n to the user NT AUTHORITY\\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (\u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c LRPC) running in the application container \u041d\u0435\u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e SID (\u041d\u0435\u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e). This security permission can be modified using the Component Services administrative tool.\"\tWarning\tSystem\tMicrosoft-Windows-DistributedCOM\n05.09.2026 08:29:01.750\t5058\t\"Key file operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nProcess Information:\n\tProcess ID:\t\t8744\n\tProcess Creation Time:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:29:01.404919900Z\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tUNKNOWN\n\tKey Name:\tMicrosoft Connected Devices Platform device certificate\n\tKey Type:\tUser key.\n\nKey File Operation Information:\n\tFile Path:\tC:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Crypto\\Keys\\de7cf8a7901d2ad13e5c67c29e5d1662_aae0f96c-9dfa-4728-bee3-a8368e406b6b\n\tOperation:\tRead persisted key from file.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.750\t10016\t\"The \u0434\u043b\u044f \u043a\u043e\u043d\u043a\u0440\u0435\u0442\u043d\u043e\u0433\u043e \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f permission settings do not grant \u041b\u043e\u043a\u0430\u043b\u044c\u043d\u043e \u0410\u043a\u0442\u0438\u0432\u0430\u0446\u0438\u044f permission for the COM Server application with CLSID \n{00000000-0000-0000-0000-000000000000}\n and APPID \n{4839DDB7-58C2-48F5-8283-E1D1807D0D7D}\n to the user NT AUTHORITY\\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (\u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c LRPC) running in the application container \u041d\u0435\u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e SID (\u041d\u0435\u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e). This security permission can be modified using the Component Services administrative tool.\"\tWarning\tSystem\tMicrosoft-Windows-DistributedCOM\n05.09.2026 08:29:01.758\t5061\t\"Cryptographic operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tECDSA_P256\n\tKey Name:\tMicrosoft Connected Devices Platform device certificate\n\tKey Type:\tUser key.\n\nCryptographic Operation:\n\tOperation:\tOpen Key.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.759\t5059\t\"Key migration operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nProcess Information:\n\tProcess ID:\t\t8744\n\tProcess Creation Time:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:29:01.404919900Z\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tECDSA_P256\n\tKey Name:\tMicrosoft Connected Devices Platform device certificate\n\tKey Type:\tUser key.\n\nAdditional Information:\n\tOperation:\tExport of persistent cryptographic key.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.788\t16394\tOffline downlevel migration succeeded.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 08:29:01.794\t600\t\"Provider \"\"Registry\"\" is Started. \n\nDetails: \n\tProviderName=Registry\n\tNewProviderState=Started\n\n\tSequenceNumber=1\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=9f70008a-1e45-4e30-868f-4606c891c66e\n\tHostApplication=C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe -ExecutionPolicy Bypass New-EventLog -Source RtkAudUService -LogName Realtek\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:29:01.796\t600\t\"Provider \"\"Alias\"\" is Started. \n\nDetails: \n\tProviderName=Alias\n\tNewProviderState=Started\n\n\tSequenceNumber=3\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=9f70008a-1e45-4e30-868f-4606c891c66e\n\tHostApplication=C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe -ExecutionPolicy Bypass New-EventLog -Source RtkAudUService -LogName Realtek\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:29:01.796\t600\t\"Provider \"\"Environment\"\" is Started. \n\nDetails: \n\tProviderName=Environment\n\tNewProviderState=Started\n\n\tSequenceNumber=5\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=9f70008a-1e45-4e30-868f-4606c891c66e\n\tHostApplication=C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe -ExecutionPolicy Bypass New-EventLog -Source RtkAudUService -LogName Realtek\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:29:01.797\t600\t\"Provider \"\"FileSystem\"\" is Started. \n\nDetails: \n\tProviderName=FileSystem\n\tNewProviderState=Started\n\n\tSequenceNumber=7\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=9f70008a-1e45-4e30-868f-4606c891c66e\n\tHostApplication=C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe -ExecutionPolicy Bypass New-EventLog -Source RtkAudUService -LogName Realtek\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:29:01.797\t600\t\"Provider \"\"Function\"\" is Started. \n\nDetails: \n\tProviderName=Function\n\tNewProviderState=Started\n\n\tSequenceNumber=9\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=9f70008a-1e45-4e30-868f-4606c891c66e\n\tHostApplication=C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe -ExecutionPolicy Bypass New-EventLog -Source RtkAudUService -LogName Realtek\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:29:01.797\t600\t\"Provider \"\"Variable\"\" is Started. \n\nDetails: \n\tProviderName=Variable\n\tNewProviderState=Started\n\n\tSequenceNumber=11\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=9f70008a-1e45-4e30-868f-4606c891c66e\n\tHostApplication=C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe -ExecutionPolicy Bypass New-EventLog -Source RtkAudUService -LogName Realtek\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:29:01.803\t400\t\"Engine state is changed from None to Available. \n\nDetails: \n\tNewEngineState=Available\n\tPreviousEngineState=None\n\n\tSequenceNumber=13\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=9f70008a-1e45-4e30-868f-4606c891c66e\n\tHostApplication=C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe -ExecutionPolicy Bypass New-EventLog -Source RtkAudUService -LogName Realtek\n\tEngineVersion=5.1.26100.9168\n\tRunspaceId=b4ac8dc4-2f88-4eea-a562-fe8eca0c95d0\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:29:01.807\t40962\tPowerShell console is ready for user input\tInformation\tMicrosoft-Windows-PowerShell/Operational\tMicrosoft-Windows-PowerShell\n05.09.2026 08:29:01.810\t8002\t\"Successfully loaded an existing hardware Windows Hello container.\n\nID: {37b5cc48-d2d4-4aab-93e7-8e74ef7366bd}\nVersion: 1\nHas Cached Logon Key: true\nState: Okay\"\t16\tMicrosoft-Windows-HelloForBusiness/Operational\tMicrosoft-Windows-HelloForBusiness\n05.09.2026 08:29:01.854\t5058\t\"Key file operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-19\n\tAccount Name:\t\tLOCAL SERVICE\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E5\n\nProcess Information:\n\tProcess ID:\t\t9572\n\tProcess Creation Time:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:29:01.782937100Z\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tUNKNOWN\n\tKey Name:\tMicrosoft Connected Devices Platform device certificate\n\tKey Type:\tUser key.\n\nKey File Operation Information:\n\tFile Path:\tC:\\WINDOWS\\ServiceProfiles\\LocalService\\AppData\\Roaming\\Microsoft\\Crypto\\Keys\\de7cf8a7901d2ad13e5c67c29e5d1662_aae0f96c-9dfa-4728-bee3-a8368e406b6b\n\tOperation:\tRead persisted key from file.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.855\t5061\t\"Cryptographic operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-19\n\tAccount Name:\t\tLOCAL SERVICE\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E5\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tECDSA_P256\n\tKey Name:\tMicrosoft Connected Devices Platform device certificate\n\tKey Type:\tUser key.\n\nCryptographic Operation:\n\tOperation:\tOpen Key.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.856\t5059\t\"Key migration operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-19\n\tAccount Name:\t\tLOCAL SERVICE\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E5\n\nProcess Information:\n\tProcess ID:\t\t9572\n\tProcess Creation Time:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:29:01.782937100Z\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tECDSA_P256\n\tKey Name:\tMicrosoft Connected Devices Platform device certificate\n\tKey Type:\tUser key.\n\nAdditional Information:\n\tOperation:\tExport of persistent cryptographic key.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.874\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:01.874\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:01.875\t1700\tSystem Migration Task Started.\tInformation\tMicrosoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Admin\tMicrosoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider\n05.09.2026 08:29:01.877\t1708\tImpersonation result. Result: (An attempt was made to reference a token that does not exist.).\tInformation\tMicrosoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Admin\tMicrosoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider\n05.09.2026 08:29:01.882\t1025\tA Power event was fired: BatterySaverStateChange [PowerEventType] false [Enabled].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:01.883\t1025\tA Power event was fired: ACPowerChange [PowerEventType] true [Enabled].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:01.883\t1025\tA Power event was fired: OpportunisticConnectedStandbyStateChange [PowerEventType] false [Enabled].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:01.884\t1025\tA Power event was fired: MonitorSettingChange [PowerEventType] true [Enabled].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:01.885\t1066\t\"Initialization status for service objects.\nC:\\WINDOWS\\system32\\sppwinob.dll, msft:spp/windowsfunctionality/agent/7.0, 0x00000000, 0x00000000\nC:\\WINDOWS\\system32\\sppobjs.dll, msft:rm/algorithm/inherited/1.0, 0x00000000, 0x00000000\nC:\\WINDOWS\\system32\\sppobjs.dll, msft:rm/algorithm/phone/1.0, 0x00000000, 0x00000000\nC:\\WINDOWS\\system32\\sppobjs.dll, msft:rm/algorithm/pkey/detect, 0x00000000, 0x00000000\nC:\\WINDOWS\\system32\\sppobjs.dll, msft:spp/ActionScheduler/1.0, 0x00000000, 0x00000000\nC:\\WINDOWS\\system32\\sppobjs.dll, msft:spp/TaskScheduler/1.0, 0x00000000, 0x00000000\nC:\\WINDOWS\\system32\\sppobjs.dll, msft:spp/statecollector/pkey, 0x00000000, 0x00000000\nC:\\WINDOWS\\system32\\sppobjs.dll, msft:spp/volume/services/kms/1.0, 0x00000000, 0x00000000\nC:\\WINDOWS\\system32\\sppobjs.dll, msft:spp/volume/services/kms/activationinfo/1.0, 0x00000000, 0x00000000\n\"\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 08:29:01.909\t1023\tNo internet connection available, ConnectWork is queued for next network status change.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:01.916\t8025\tThe Microsoft Passport Container service started successfully.\t16\tMicrosoft-Windows-HelloForBusiness/Operational\tMicrosoft-Windows-HelloForBusiness\n05.09.2026 08:29:01.922\t2102\t\"Ctap command completed.\n\nTransactionId: {ec5295cc-66be-4c4e-b2bb-2a8769b4eb95}\nResponse: \"\t16\tMicrosoft-Windows-WebAuthN/Operational\tMicrosoft-Windows-WebAuthN\n05.09.2026 08:29:01.941\t3006\tToast session creation is requested for C:\\Windows\\System32\\svchost.exe from endpoint 0x0.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:01.941\t3007\tToast session creation is finished for C:\\Windows\\System32\\svchost.exe from endpoint 0x0 with result The operation completed successfully., and 1 is assigned as session id.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:01.974\t263\tWDDM graphics mode is enabled\tInformation\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager/Operational\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager\n05.09.2026 08:29:01.983\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:01.998\t61\tIs the Battery Saver state enabled: false\tInformation\tMicrosoft-Windows-UniversalTelemetryClient/Operational\tMicrosoft-Windows-UniversalTelemetryClient\n05.09.2026 08:29:01.998\t62\tIs the device in connected standby: false\tInformation\tMicrosoft-Windows-UniversalTelemetryClient/Operational\tMicrosoft-Windows-UniversalTelemetryClient\n05.09.2026 08:29:02.022\t63\tA provider, IntelMEProv, has been registered in the Windows Management Instrumentation namespace root\\Intel_ME to use the LocalSystem account. This account is privileged and the provider may cause a security violation if it does not correctly impersonate user requests.\tWarning\tApplication\tMicrosoft-Windows-WMI\n05.09.2026 08:29:02.030\t63\tA provider, IntelMEProv, has been registered in the Windows Management Instrumentation namespace root\\Intel_ME to use the LocalSystem account. This account is privileged and the provider may cause a security violation if it does not correctly impersonate user requests.\tWarning\tApplication\tMicrosoft-Windows-WMI\n05.09.2026 08:29:02.037\t63\tA provider, IntelMEProv, has been registered in the Windows Management Instrumentation namespace root\\Intel_ME to use the LocalSystem account. This account is privileged and the provider may cause a security violation if it does not correctly impersonate user requests.\tWarning\tApplication\tMicrosoft-Windows-WMI\n05.09.2026 08:29:02.058\t2\tIntel(R) WMI Registration Service has successfully finished WMI Registration.\tInformation\tApplication\tWMIRegistrationService\n05.09.2026 08:29:02.060\t8000\t\"Process Name: C:\\WINDOWS\\system32\\sihost.exe\nModule Name: C:\\WINDOWS\\SYSTEM32\\licensemanagerapi.dll\nBuild: 26100.1.amd64fre.ge_release.240331-1435\n\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:02.127\t0\tService started successfully.\tInformation\tApplication\tSamsungQuickShareService\n05.09.2026 08:29:02.156\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:02.156\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:02.180\t403\t\"Engine state is changed from Available to Stopped. \n\nDetails: \n\tNewEngineState=Stopped\n\tPreviousEngineState=Available\n\n\tSequenceNumber=47\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=9f70008a-1e45-4e30-868f-4606c891c66e\n\tHostApplication=C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe -ExecutionPolicy Bypass New-EventLog -Source RtkAudUService -LogName Realtek\n\tEngineVersion=5.1.26100.9168\n\tRunspaceId=b4ac8dc4-2f88-4eea-a562-fe8eca0c95d0\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:29:02.182\t1003\t\"The Windows Search Service started.\n\"\tInformation\tApplication\tMicrosoft-Windows-Search\n05.09.2026 08:29:02.185\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-544\n\tGroup Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u044b\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x2240\n\tProcess Name:\t\tC:\\Windows\\System32\\SearchIndexer.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:02.187\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-551\n\tGroup Name:\t\t\u041e\u043f\u0435\u0440\u0430\u0442\u043e\u0440\u044b \u0430\u0440\u0445\u0438\u0432\u0430\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x2240\n\tProcess Name:\t\tC:\\Windows\\System32\\SearchIndexer.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:02.199\t8000\t\"Process Name: C:\\WINDOWS\\system32\\svchost.exe\nModule Name: C:\\WINDOWS\\SYSTEM32\\licensemanagerapi.dll\nBuild: 26100.1.amd64fre.ge_release.240331-1435\n\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:02.201\t219\tPSMFlags for Desktop AppX process %1 with applicationID %2 is %3.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:02.216\t210\tCreated Desktop AppX container {245CDAF2-A8C9-11F1-B7FF-289200F24A99} for package MicrosoftWindows.Client.CBS_1000.26100.344.0_x64__cw5n1h2txyewy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:02.216\t211\tAdded process 9000 to Desktop AppX container 245cdaf2-a8c9-11f1-b7ff-289200f24a99 for package MicrosoftWindows.Client.CBS_1000.26100.344.0_x64__cw5n1h2txyewy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:02.220\t201\tCreated process 9000 for application MicrosoftWindows.Client.CBS_cw5n1h2txyewy!CrossDeviceResumeApp in package MicrosoftWindows.Client.CBS_1000.26100.344.0_x64__cw5n1h2txyewy. [LaunchProcess]\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:02.235\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:02.235\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:02.260\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:02.260\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:02.301\t62170\tLogon task 'AllLogonTasks' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.302\t62170\tLogon task 'PreRoamingTasks' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.302\t62170\tLogon task 'BackupRestoreCoordinator' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.302\t62171\tLogon task 'BackupRestoreCoordinator' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.302\t62170\tLogon task 'ShellPrep' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.303\t62443\tAppDefault Info: File Association hash version is still the same\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.303\t62171\tLogon task 'ShellPrep' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.303\t62170\tLogon task 'DefaultAssociations' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.303\t62170\tLogon task 'AppReadinessPreRoamingGroup' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.303\t62170\tLogon task 'AppReadinessPreShellGroup' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.303\t62170\tLogon task 'AppResolver' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.303\t62170\tLogon task 'SkydrivePrep' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.303\t62171\tLogon task 'SkydrivePrep' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.303\t62170\tLogon task 'RunOnce' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.303\t62170\tLogon task 'GetLanguageOverlayPackage' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.303\t62171\tLogon task 'GetLanguageOverlayPackage' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.305\t62443\tAppDefault Info: AppDefaults-Logon-UserProfileLoaded\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.305\t28125\tStarting to refresh app resolver cache for scenario 1 with flags 268.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.308\t62171\tLogon task 'DefaultAssociations' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.320\t62171\tLogon task 'RunOnce' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.320\t62170\tLogon task 'ActiveSetup' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.324\t62171\tLogon task 'ActiveSetup' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.324\t62170\tLogon task 'WaitForMSAConnected' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.324\t62171\tLogon task 'WaitForMSAConnected' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.324\t62170\tLogon task 'ClickToDoEligibility' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.324\t62170\tLogon task 'CacheUserEligibility' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.324\t62170\tLogon task 'RefreshOneSettingsFeatureConfigurations' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.324\t62171\tLogon task 'RefreshOneSettingsFeatureConfigurations' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.337\t62171\tLogon task 'ClickToDoEligibility' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.337\t62171\tLogon task 'AppReadinessPreRoamingGroup' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.337\t62171\tLogon task 'PreRoamingTasks' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.337\t62170\tLogon task 'PreShellTasks' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.338\t62170\tLogon task 'AppRestore' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.338\t62171\tLogon task 'AppRestore' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.338\t62170\tLogon task 'StartLayoutInit' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.338\t62170\tLogon task 'DownloadEduThemes' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.338\t62170\tLogon task 'UgradeTaskFlowPolicy' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.338\t62171\tLogon task 'UgradeTaskFlowPolicy' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.338\t62170\tLogon task 'LaunchProgrammableTaskbarCloudManager' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.338\t62171\tLogon task 'LaunchProgrammableTaskbarCloudManager' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.338\t62171\tLogon task 'DownloadEduThemes' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.338\t62170\tLogon task 'ShellHandwriting' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.338\t62171\tLogon task 'ShellHandwriting' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.338\t62171\tLogon task 'AppReadinessPreShellGroup' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.339\t62171\tLogon task 'AppResolver' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.339\t62171\tLogon task 'PreShellTasks' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.339\t62170\tLogon task 'ShellInitTasks' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.339\t62170\tLogon task 'AppReadinessLogonGroup' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.339\t62170\tLogon task 'UpdatePCSettingsShellInit' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.339\t62171\tLogon task 'UpdatePCSettingsShellInit' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.339\t62170\tLogon task 'InstallPWAs' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.341\t9703\tRunOnce commands started.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.342\t9705\tStarted enumeration of commands for registry key 'Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce'.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.343\t9707\tStarted execution of command 'setup.exe\" --msedgewebview --delete-old-versions --system-level --verbose-logging --on-logon'.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.350\t2413\tAn application was registered with the following parameters: windows.immersivecontrolpanel_cw5n1h2txyewy [PackageFullName] windows.immersivecontrolpanel_cw5n1h2txyewy!microsoft.windows.immersivecontrolpanel [AppUserModelId] 0x600 [Settings] 268435456 [AppType] The operation completed successfully. [ErrorCode].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:02.353\t603\tStarted deployment Stage operation on a package with main parameter MdOdrMcpFilter.msix and Options ForceUpdateFromAnyVersion,NormalPriorityRequest and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:02.395\t62171\tLogon task 'CacheUserEligibility' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.395\t62171\tLogon task 'AppReadinessLogonGroup' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.396\t62171\tLogon task 'InstallPWAs' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.396\t62171\tLogon task 'ShellInitTasks' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.477\t501\t\"A process has deleted a USN journal on a volume.\n\n           Process: SearchIndexer.\n           Volume Id: {23606dfe-da07-4ad7-8798-8deaced0a66e}\n           Volume Name: C:\n           Journal Id: 0x1DC755BE25CD000\n           Current USN: 0x0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:29:02.482\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-544\n\tGroup Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u044b\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x217c\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:02.486\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-544\n\tGroup Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u044b\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x217c\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:02.490\t501\t\"A process has deleted a USN journal on a volume.\n\n           Process: SearchIndexer.\n           Volume Id: {b4de30fc-d998-46fa-9187-a8f915fd81fc}\n           Volume Name: D:\n           Journal Id: 0x1DCE9F9F77DCD9D\n           Current USN: 0x0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:29:02.501\t157\tThe app package signature was validated for core content of the app package published by CN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=US. Payload won't be validated until the files are read.\tInformation\tMicrosoft-Windows-AppxPackaging/Operational\tMicrosoft-Windows-AppxPackagingOM\n05.09.2026 08:29:02.523\t2084\t\"Added a Duplicate Rule\n\nRule Name:\t@{Microsoft.XboxIdentityProvider_12.130.16001.0_x64__8wekyb3d8bbwe?ms-resource://Microsoft.XboxIdentityProvider/Resources/DisplayName}\n\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:29:02.523\t2084\t\"Added a Duplicate Rule\n\nRule Name:\t@{Microsoft.Getstarted_10.2312.1.0_x64__8wekyb3d8bbwe?ms-resource://Microsoft.Getstarted/Resources/AppStoreName}\n\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:29:02.524\t2084\t\"Added a Duplicate Rule\n\nRule Name:\t@{Microsoft.WindowsCamera_2025.2510.2.0_x64__8wekyb3d8bbwe?ms-resource://Microsoft.WindowsCamera/LensSDK/Resources/AppStoreName}\n\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:29:02.524\t2084\t\"Added a Duplicate Rule\n\nRule Name:\t@{Microsoft.WindowsCamera_2025.2510.2.0_x64__8wekyb3d8bbwe?ms-resource://Microsoft.WindowsCamera/LensSDK/Resources/AppStoreName}\n\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:29:02.524\t2084\t\"Added a Duplicate Rule\n\nRule Name:\t@{Microsoft.WindowsCalculator_11.2508.4.0_x64__8wekyb3d8bbwe?ms-resource://Microsoft.WindowsCalculator/Resources/AppStoreName}\n\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:29:02.524\t2084\t\"Added a Duplicate Rule\n\nRule Name:\t@{Microsoft.ZuneVideo_10.25121.10051.0_x64__8wekyb3d8bbwe?ms-resource://Microsoft.ZuneVideo/resources/IDS_MANIFEST_VIDEO_APP_NAME}\n\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:29:02.524\t2084\t\"Added a Duplicate Rule\n\nRule Name:\t@{Microsoft.ZuneVideo_10.25121.10051.0_x64__8wekyb3d8bbwe?ms-resource://Microsoft.ZuneVideo/resources/IDS_MANIFEST_VIDEO_APP_NAME}\n\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:29:02.524\t2084\t\"Added a Duplicate Rule\n\nRule Name:\t@{Microsoft.People_10.2202.100.0_x64__8wekyb3d8bbwe?ms-resource://Microsoft.People/Resources/AppStoreName}\n\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:29:02.524\t2084\t\"Added a Duplicate Rule\n\nRule Name:\t@{AppUp.IntelGraphicsExperience_1.100.5688.0_x64__8j3eq9eme6ctt?ms-resource://AppUp.IntelGraphicsExperience/Resources/System_Item_Title_IntelGraphicsControlPanel}\n\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:29:02.535\t4004\t\"Network State Change Fired\n\tNew Internet Connection Profile: false\n\tConnection Cost Changed: true\n\tDomain Connectivity Level Changed: false\n\tNetwork Connectivity Level Changed: true\n\tHost Name Changed: true\n\tWwan Registration State Changed: false\n\tTethering Operational State Changed: false\n\tTethering Client Count Changed: false\"\tInformation\tMicrosoft-Windows-NetworkProfile/Operational\tMicrosoft-Windows-NetworkProfile\n05.09.2026 08:29:02.535\t55\tIs the Internet available: false\tInformation\tMicrosoft-Windows-UniversalTelemetryClient/Operational\tMicrosoft-Windows-UniversalTelemetryClient\n05.09.2026 08:29:02.535\t56\tIs a free network available: false\tInformation\tMicrosoft-Windows-UniversalTelemetryClient/Operational\tMicrosoft-Windows-UniversalTelemetryClient\n05.09.2026 08:29:02.535\t1024\tInternet connection status changed to false, submitting pending workitems: count = 1.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:02.544\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-544\n\tGroup Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u044b\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x217c\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:02.556\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-544\n\tGroup Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u044b\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x217c\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:02.564\t2059\t\"All rules have been deleted from the Windows Defender Firewall configuration on this computer.\n\n\tStore Type:\t12\n\tModifyingUser:\tS-1-5-80-3088073201-1464728630-1879813800-1107566885-823218052\n\tModifyingApplication:\tC:\\WINDOWS\\System32\\svchost.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:29:02.564\t2051\t\"Tenant Restrictions Policy Update\n\nError code:\t0\nPolicy Change:\t0\n\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:29:02.566\t5024\tThe Windows Firewall service started successfully.\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:02.585\t170\tThe streaming reader was created successfully for app package MdOdrMcpFilterPackage_1.0.0.0_neutral__cw5n1h2txyewy.\tInformation\tMicrosoft-Windows-AppxPackaging/Operational\tMicrosoft-Windows-AppxPackagingOM\n05.09.2026 08:29:02.587\t9648\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.593\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_2.rslc for Stage Operation on Package MdOdrMcpFilterPackage_1.0.0.0_neutral__cw5n1h2txyewy.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:02.594\t607\tDeployment Stage operation on package MdOdrMcpFilterPackage_1.0.0.0_neutral__cw5n1h2txyewy has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:02.594\t854\tSuccessfully added the following uri(s) to be processed:  file:///C:/ProgramData/Microsoft/Windows%20Defender/Platform/4.18.26080.3-0/MdOdrMcpFilter.msix.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:02.596\t867\tWindows cannot install package MdOdrMcpFilterPackage_1.0.0.0_neutral__cw5n1h2txyewy because it is already installed with a different external location.\tError\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:02.622\t605\tError 0x80073D0B: Failure in the Indexed state handler.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:02.625\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:02.625\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:02.630\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:29:02.630\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-544\n\tGroup Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u044b\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x217c\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:02.634\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-544\n\tGroup Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u044b\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x217c\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:02.641\t401\tDeployment Stage operation with target volume C: on Package MdOdrMcpFilterPackage_1.0.0.0_neutral__cw5n1h2txyewy from:  (MdOdrMcpFilter.msix)  failed with error 0x80073D0B. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tError\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:02.641\t698\tDeployment Stage operation with target volume C: on Package MdOdrMcpFilterPackage_1.0.0.0_neutral__cw5n1h2txyewy from:  (MdOdrMcpFilter.msix)  failed with error 0x80073D0B. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tError\tMicrosoft-Windows-AppXDeploymentServer/Restricted\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:02.661\t404\tAppX Deployment operation failed for package MdOdrMcpFilterPackage_1.0.0.0_neutral__cw5n1h2txyewy with error 0x80073D0B. The specific error text for this failure is: Windows \u043d\u0435 \u0443\u0434\u0430\u0435\u0442\u0441\u044f \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u0438\u0442\u044c MdOdrMcpFilterPackage_1.0.0.0_neutral__cw5n1h2txyewy \u043f\u0430\u043a\u0435\u0442\u043e\u0432, \u0442\u0430\u043a \u043a\u0430\u043a \u043e\u043d \u0443\u0436\u0435 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043b\u0435\u043d \u0441 \u0434\u0440\u0443\u0433\u0438\u043c \u0432\u043d\u0435\u0448\u043d\u0438\u043c \u0440\u0430\u0441\u043f\u043e\u043b\u043e\u0436\u0435\u043d\u0438\u0435\u043c. \tError\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:02.662\t613\t\"Performance summary of Deployment Stage operation on Package MdOdrMcpFilterPackage_1.0.0.0_neutral__cw5n1h2txyewy: Failed to reach state Indexed\nOverall time: 281 ms (Active time: 281 ms)\nEnqueue cost: 219 ms\nDequeue delay: 0 ms\nBundle processing cost: 0 ms\nIndexing cost: 31 ms\nResolve dependency cost: 0 ms\nCheck approval cost: 0 ms\nEvaluation cost: 0 ms\nHardlinking evaluation cost: 0 ms\nStage required cost: 0 ms\nFlushing and closing files cost: 0 ms\nMachine register cost: 0 ms\nStage user data cost: 0 ms\nRegistration cost: 0 ms\nRepository commit transaction cost: 0 ms\nData flush cost: 0 ms\nPost DeStage repository commit transaction cost: 0 ms\nRemaining cost: 31 ms\n\"\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:02.683\t8000\t\"Process Name: C:\\WINDOWS\\system32\\svchost.exe\nModule Name: C:\\WINDOWS\\SYSTEM32\\licensemanagerapi.dll\nBuild: 26100.1.amd64fre.ge_release.240331-1435\n\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:02.684\t8001\t\"canDisableApps value is 0\nFunction: InitStoreAppsAreDisabled\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (195)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:02.685\t8001\t\"Skipping license manager: PFN MicrosoftWindows.CrossDevice_1.26052.99.0_x64__cw5n1h2txyewy\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:02.702\t501\t\"A process has deleted a USN journal on a volume.\n\n           Process: SearchIndexer.\n           Volume Id: {5285d7ae-0000-0000-0000-300432000000}\n           Volume Name: F:\n           Journal Id: 0x19DB31D0AD8ABD4\n           Current USN: 0x0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:29:02.759\t210\tCreated Desktop AppX container {245CDB00-A8C9-11F1-B7FF-289200F24A99} for package MicrosoftWindows.CrossDevice_1.26052.99.0_x64__cw5n1h2txyewy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:02.759\t211\tAdded process 10344 to Desktop AppX container 245cdb00-a8c9-11f1-b7ff-289200f24a99 for package MicrosoftWindows.CrossDevice_1.26052.99.0_x64__cw5n1h2txyewy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:02.788\t265\t1 predictions were fetched for transforms '' and PCRs 7,11. USN: 0, Matching PCRs: 1,2,3,4,5,6,7,8,9,10,11.\tInformation\tMicrosoft-Windows-PCRPF/PCRPF\tMicrosoft-Windows-PCRPF\n05.09.2026 08:29:02.909\t9649\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.909\t62170\tLogon task 'PreStartTasks' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.909\t62170\tLogon task 'LaunchExperienceHost' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.909\t28125\tStarting to refresh app resolver cache for scenario 1 with flags 2316.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.914\t62170\tLogon task 'LaunchContentDeliveryManagerStart' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.919\t62171\tLogon task 'LaunchContentDeliveryManagerStart' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.919\t62170\tLogon task 'PerformSignInSuggestionsStart' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.919\t62171\tLogon task 'PerformSignInSuggestionsStart' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.919\t62170\tLogon task 'UpdatePCSettingsPreStart' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.919\t62171\tLogon task 'UpdatePCSettingsPreStart' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.919\t62170\tLogon task 'EnterpriseProvisioning' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.919\t62171\tLogon task 'EnterpriseProvisioning' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.919\t62170\tLogon task 'AssignedAccessLogonTaskAgentPreStart' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.919\t62170\tLogon task 'WSXRegistryInitPreStart' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.919\t62171\tLogon task 'WSXRegistryInitPreStart' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.919\t62170\tLogon task 'ConfigureA9InstallOptionalComponent' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.921\t1282\tThe TBS device identifier has been generated.\tInformation\tSystem\tMicrosoft-Windows-TPM-WMI\n05.09.2026 08:29:02.926\t62171\tLogon task 'ConfigureA9InstallOptionalComponent' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.926\t62170\tLogon task 'PerUserSetup' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.926\t62170\tLogon task 'RemoveC2DShortcut' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.926\t62171\tLogon task 'RemoveC2DShortcut' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.930\t360\t\"Windows Hello for Business provisioning will not be launched. \nDevice is Microsoft Entra joined (or hybrid joined): Not Tested \nUser has logged on with Microsoft Entra credentials: No \nWindows Hello for Business policy is enabled: Not Tested \nWindows Hello for Business post-logon provisioning is enabled: Not Tested \nLocal computer meets Windows hello for business hardware requirements: Not Tested \nUser is not connected to the machine via Remote Desktop: Yes \nUser certificate for on premise auth policy is enabled: Not Tested \nMachine is governed by none policy. \nCloud trust for on premise auth policy is enabled: Not Tested \nUser account has Cloud to OnPrem TGT: Not Tested \nSee https://go.microsoft.com/fwlink/?linkid=832647 for more details.\"\tWarning\tMicrosoft-Windows-User Device Registration/Admin\tMicrosoft-Windows-User Device Registration\n05.09.2026 08:29:02.972\t62171\tLogon task 'StartLayoutInit' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.107\t8001\t\"Skipping license manager: PFN MicrosoftWindows.Client.WebExperience_526.17301.40.0_x64__cw5n1h2txyewy\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:03.152\t210\tCreated Desktop AppX container {245CDB0F-A8C9-11F1-B7FF-289200F24A99} for package MicrosoftWindows.Client.WebExperience_526.17301.40.0_x64__cw5n1h2txyewy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:03.152\t211\tAdded process 11012 to Desktop AppX container 245cdb0f-a8c9-11f1-b7ff-289200f24a99 for package MicrosoftWindows.Client.WebExperience_526.17301.40.0_x64__cw5n1h2txyewy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:03.255\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:03.267\t8100\tStarting validation and setting the Trust Label on package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:03.269\t8106\tPackage Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe has Trust Label already. Flags: 0x103\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:03.269\t8101\tFinished validation and setting the Trust Label on package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:03.327\t16\tCounter 11 of instance ({00000000-0000-0000-0000-000000000000}, NULL, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:03.327\t16\tCounter 6 of instance ({00000000-0000-0000-0000-000000000000}, NULL, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:03.327\t16\tCounter 11 of instance ({00000000-0000-0000-0000-000000000000}, NULL, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:03.327\t16\tCounter 6 of instance ({00000000-0000-0000-0000-000000000000}, NULL, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:03.329\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.329\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.331\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:03.336\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:03.362\t3\tInstance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, WMIProv, 0) could not be created. Error: \"Cannot create a file when that file already exists.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:03.388\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.389\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.389\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.398\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.398\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.398\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.400\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.400\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.400\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.570\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:03.577\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:03.601\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:03.618\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.726\t1002\tError 0x80070005 occurred while verifying known folder {62ab5d82-fdc1-4dc3-a9dd-070d1d495d97} with path 'C:\\ProgramData'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:29:03.745\t62171\tLogon task 'LaunchExperienceHost' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.745\t62171\tLogon task 'AssignedAccessLogonTaskAgentPreStart' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.745\t62171\tLogon task 'PerformSignInSuggestions' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.746\t62171\tLogon task 'PerUserSetup' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.746\t62171\tLogon task 'PreStartTasks' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.750\t62171\tLogon task 'AllLogonTasks' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.751\t62170\tLogon task 'PostStartTasks' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.751\t62170\tLogon task 'PerUserSetupPostStart' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.751\t62171\tLogon task 'PerUserSetupPostStart' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.751\t62170\tLogon task 'LaunchExperienceHostPostStart' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.751\t62171\tLogon task 'LaunchExperienceHostPostStart' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.751\t62170\tLogon task 'LaunchPeopleExperiencePostStart' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.751\t62170\tLogon task 'LaunchLockAppHostPostStart' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.751\t62171\tLogon task 'LaunchLockAppHostPostStart' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.751\t62170\tLogon task 'AssignedAccessAutoLaunch' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.751\t62170\tLogon task 'AppReadinessNotifyLogonComplete' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.751\t62170\tLogon task 'LaunchInputDialListenerPostStart' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.751\t62171\tLogon task 'LaunchPeopleExperiencePostStart' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.751\t62171\tLogon task 'AppReadinessNotifyLogonComplete' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.751\t62170\tLogon task 'NotifyTrayStartIsReady' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.751\t62170\tLogon task 'FixUserTileStoreCorruption' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.751\t62170\tLogon task 'OEMFirstRunTelemetry' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.751\t62171\tLogon task 'NotifyTrayStartIsReady' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.751\t62171\tLogon task 'OEMFirstRunTelemetry' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.752\t9648\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.752\t9652\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.752\t62170\tLogon task 'StartSkydriveSync' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.752\t62171\tLogon task 'FixUserTileStoreCorruption' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.752\t62170\tLogon task 'ResumeAppRestore' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.752\t62171\tLogon task 'ResumeAppRestore' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.752\t62170\tLogon task 'PrepareSettingSearch' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.752\t62171\tLogon task 'PrepareSettingSearch' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.752\t62170\tLogon task 'CommercialHomePageSetup' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.753\t62171\tLogon task 'PostStartTasks' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.753\t62171\tLogon task 'CommercialHomePageSetup' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.753\t62170\tLogon task 'RemoveTempOOBEUser' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.753\t62171\tLogon task 'RemoveTempOOBEUser' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.753\t62170\tLogon task 'InitializeBrowserSsoCookie' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.754\t62171\tLogon task 'InitializeBrowserSsoCookie' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.754\t62170\tLogon task 'CreateEdgeIconIfNeededPostStart' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.754\t62170\tLogon task 'CreateYourPhoneShortcutsIfNeededPostStart' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.754\t62171\tLogon task 'CreateYourPhoneShortcutsIfNeededPostStart' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.754\t62170\tLogon task 'LaunchLockScreenCacheImageRestorePostStart' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.754\t62171\tLogon task 'LaunchLockScreenCacheImageRestorePostStart' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.754\t62171\tLogon task 'CreateEdgeIconIfNeededPostStart' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.754\t62170\tLogon task 'LaunchExplorerDestListMigrationPostStart' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.754\t62171\tLogon task 'LaunchExplorerDestListMigrationPostStart' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.754\t62170\tLogon task 'LaunchCustomShell' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.754\t62170\tLogon task 'FamilySync' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.754\t62171\tLogon task 'FamilySync' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.755\t62170\tLogon task 'FamilyMembersNotification' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.755\t9653\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.755\t9652\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.755\t62171\tLogon task 'FamilyMembersNotification' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.755\t62170\tLogon task 'CloudDataRestore' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.755\t62170\tLogon task 'CDSDataMigration' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.755\t62170\tLogon task 'LaunchExplorerNamespaceRestrictionPostStart' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.755\t62171\tLogon task 'StartSkydriveSync' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.755\t62170\tLogon task 'CloudDataUpdateProfileName' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.756\t62170\tLogon task 'WSXRegistryInit' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.756\t9652\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.756\t62171\tLogon task 'LaunchExplorerNamespaceRestrictionPostStart' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.757\t9652\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.757\t62171\tLogon task 'WSXRegistryInit' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.758\t62171\tLogon task 'LaunchCustomShell' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.759\t62171\tLogon task 'AssignedAccessAutoLaunch' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.761\t76\tError: ClassFactory cannot supply requested class; See event details for more information.\tError\tMicrosoft-Windows-CloudRestoreLauncher/Operational\tMicrosoft-Windows-CloudRestoreLauncher\n05.09.2026 08:29:03.762\t76\tError: ClassFactory cannot supply requested class; See event details for more information.\tError\tMicrosoft-Windows-CloudRestoreLauncher/Operational\tMicrosoft-Windows-CloudRestoreLauncher\n05.09.2026 08:29:03.762\t62171\tLogon task 'CDSDataMigration' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.766\t62171\tLogon task 'LaunchInputDialListenerPostStart' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.767\t2413\tAn application was registered with the following parameters: System [PackageFullName] Windows.SystemToast.WindowsTip [AppUserModelId] 0x24FF [Settings] 1073741824 [AppType] The operation completed successfully. [ErrorCode].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:03.772\t62171\tLogon task 'CloudDataRestore' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.776\t8001\t\"Skipping license manager: PFN Microsoft.YourPhone_1.26071.164.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:03.782\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:03.783\t62171\tLogon task 'CloudDataUpdateProfileName' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.792\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:03.793\t211\tAdded process 11816 to Desktop AppX container 245cdaf2-a8c9-11f1-b7ff-289200f24a99 for package MicrosoftWindows.Client.CBS_1000.26100.344.0_x64__cw5n1h2txyewy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:03.811\t5058\t\"Key file operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-19\n\tAccount Name:\t\tLOCAL SERVICE\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E5\n\nProcess Information:\n\tProcess ID:\t\t9572\n\tProcess Creation Time:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:29:01.782937100Z\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tUNKNOWN\n\tKey Name:\t8aa0580351688ef0\n\tKey Type:\tUser key.\n\nKey File Operation Information:\n\tFile Path:\tC:\\WINDOWS\\ServiceProfiles\\LocalService\\AppData\\Roaming\\Microsoft\\Crypto\\Keys\\59f36b963030275e362572ca6929e329_aae0f96c-9dfa-4728-bee3-a8368e406b6b\n\tOperation:\tRead persisted key from file.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.811\t5061\t\"Cryptographic operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-19\n\tAccount Name:\t\tLOCAL SERVICE\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E5\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tECDSA_P256\n\tKey Name:\t8aa0580351688ef0\n\tKey Type:\tUser key.\n\nCryptographic Operation:\n\tOperation:\tOpen Key.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.812\t5059\t\"Key migration operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-19\n\tAccount Name:\t\tLOCAL SERVICE\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E5\n\nProcess Information:\n\tProcess ID:\t\t9572\n\tProcess Creation Time:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:29:01.782937100Z\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tECDSA_P256\n\tKey Name:\t8aa0580351688ef0\n\tKey Type:\tUser key.\n\nAdditional Information:\n\tOperation:\tExport of persistent cryptographic key.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.817\t5058\t\"Key file operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-19\n\tAccount Name:\t\tLOCAL SERVICE\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E5\n\nProcess Information:\n\tProcess ID:\t\t9572\n\tProcess Creation Time:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:29:01.782937100Z\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tUNKNOWN\n\tKey Name:\t67f81be80651088b\n\tKey Type:\tUser key.\n\nKey File Operation Information:\n\tFile Path:\tC:\\WINDOWS\\ServiceProfiles\\LocalService\\AppData\\Roaming\\Microsoft\\Crypto\\Keys\\e3c1979771f00a27e89a2c7cfb43c0fc_aae0f96c-9dfa-4728-bee3-a8368e406b6b\n\tOperation:\tRead persisted key from file.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.818\t5061\t\"Cryptographic operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-19\n\tAccount Name:\t\tLOCAL SERVICE\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E5\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tECDSA_P256\n\tKey Name:\t67f81be80651088b\n\tKey Type:\tUser key.\n\nCryptographic Operation:\n\tOperation:\tOpen Key.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.819\t5059\t\"Key migration operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-19\n\tAccount Name:\t\tLOCAL SERVICE\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E5\n\nProcess Information:\n\tProcess ID:\t\t9572\n\tProcess Creation Time:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:29:01.782937100Z\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tECDSA_P256\n\tKey Name:\t67f81be80651088b\n\tKey Type:\tUser key.\n\nAdditional Information:\n\tOperation:\tExport of persistent cryptographic key.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.876\t5007\t\"\u0410\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043d\u0430\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430 Microsoft Defender Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.\n \tOld value: HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\Diagnostics\\InitializingComponentProgress = PostPlatformUpdate\n \tNew value: HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\Diagnostics\\InitializingComponentProgress = RegistringUxToastLibrary\"\tInformation\tMicrosoft-Windows-Windows Defender/Operational\tMicrosoft-Windows-Windows Defender\n05.09.2026 08:29:03.899\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.903\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.903\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.906\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.907\t505\t\"Compatibility fix applied to C:\\WINDOWS\\system32\\backgroundTaskHost.exe.\nFix information: Microsoft Apps, {81ecdb97-5112-41af-9a59-5ba9444f4270}, 0x80010101.\"\tInformation\tMicrosoft-Windows-Application-Experience/Program-Telemetry\tMicrosoft-Windows-Application-Experience\n05.09.2026 08:29:03.908\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p -s wlidsvc( #0x0/0x11272 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:29:03.911\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.932\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.933\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.977\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.977\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.977\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.060\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.063\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.064\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.067\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.070\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p -s wlidsvc( #0x0/0x11272 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:29:04.071\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.102\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.103\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.135\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.135\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.135\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.180\t1002\tError 0x80070005 occurred while verifying known folder {62ab5d82-fdc1-4dc3-a9dd-070d1d495d97} with path 'C:\\ProgramData'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:29:04.186\t1002\tError 0x80070005 occurred while verifying known folder {b4bfcc3a-db2c-424c-b029-7fe99a87c641} with path 'C:\\Users\\admin\\Desktop'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:29:04.192\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.195\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.195\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.197\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.199\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p -s wlidsvc( #0x0/0x11272 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:29:04.200\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.217\t1002\tError 0x80070005 occurred while verifying known folder {5e6c858f-0e22-4760-9afe-ea3317b67173} with path 'C:\\Users\\admin'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:29:04.257\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.258\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.297\t2415\tAn application was unregistered with the following parameters: Windows.Defender.MpUxDlp [AppUserModelId] The operation completed successfully. [ErrorCode]\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:04.320\t30810\t\"Added a TCP/IP transport interface.\n\nName: \u0411\u0435\u0441\u043f\u0440\u043e\u0432\u043e\u0434\u043d\u0430\u044f \u0441\u0435\u0442\u044c\nInterfaceIndex: 0x7\n\nGuidance:\nA TCP/IP binding was added to the specified network adapter for the SMB client. The SMB client can now send and receive SMB traffic on this network adapter using TCP/IP. You should expect this event when a computer restarts or when a previously disabled network adaptor is re-enabled. No user action is required.\"\tInformation\tMicrosoft-Windows-SmbClient/Connectivity\tMicrosoft-Windows-SMBClient\n05.09.2026 08:29:04.320\t1040\tReceived Mib notification type MibAddInstance for interface 7\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:29:04.320\t1034\tSend RDMA Endpoint notification failure - DadState is different from IpDadStatePreferred for interface 7. Current DadState: 1.\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:29:04.346\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.347\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.347\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.521\t27\tConnection state - All connections have succeeded since the previous period.\tInformation\tMicrosoft-Windows-UniversalTelemetryClient/Operational\tMicrosoft-Windows-UniversalTelemetryClient\n05.09.2026 08:29:04.829\t5007\t\"\u0410\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043d\u0430\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430 Microsoft Defender Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.\n \tOld value: HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\Diagnostics\\InitializingComponentProgress = RegistringUxToastLibrary\n \tNew value: HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\Diagnostics\\InitializingComponentProgress = LoadingEngine\"\tInformation\tMicrosoft-Windows-Windows Defender/Operational\tMicrosoft-Windows-Windows Defender\n05.09.2026 08:29:04.928\t30810\t\"Added a TCP/IP transport interface.\n\nName: \u0411\u0435\u0441\u043f\u0440\u043e\u0432\u043e\u0434\u043d\u0430\u044f \u0441\u0435\u0442\u044c\nInterfaceIndex: 0x7\n\nGuidance:\nA TCP/IP binding was added to the specified network adapter for the SMB client. The SMB client can now send and receive SMB traffic on this network adapter using TCP/IP. You should expect this event when a computer restarts or when a previously disabled network adaptor is re-enabled. No user action is required.\"\tInformation\tMicrosoft-Windows-SmbClient/Connectivity\tMicrosoft-Windows-SMBClient\n05.09.2026 08:29:04.928\t1040\tReceived Mib notification type MibAddInstance for interface 7\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:29:04.928\t1034\tSend RDMA Endpoint notification failure - DadState is different from IpDadStatePreferred for interface 7. Current DadState: 1.\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:29:04.929\t8000\t\"WLAN AutoConfig service started a connection to a wireless network.\n\nNetwork Adapter: Intel(R) Wi-Fi 6 AX201 160MHz\nInterface GUID: {449f824d-2856-4717-a3a7-cf59faac817a}\nConnection Mode: \u0410\u0432\u0442\u043e\u043c\u0430\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0435 \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435 \u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c \u043f\u0440\u043e\u0444\u0438\u043b\u044f\nProfile Name: HUAWEI_HG8245_WiFi\nSSID: HUAWEI_HG8245_WiFi\nBSS Type: Infrastructure\n\"\tInformation\tMicrosoft-Windows-WLAN-AutoConfig/Operational\tMicrosoft-Windows-WLAN-AutoConfig\n05.09.2026 08:29:04.946\t30810\t\"Added a TCP/IP transport interface.\n\nName: \u041f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435 \u043f\u043e \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u0439 \u0441\u0435\u0442\u0438* 9\nInterfaceIndex: 0x9\n\nGuidance:\nA TCP/IP binding was added to the specified network adapter for the SMB client. The SMB client can now send and receive SMB traffic on this network adapter using TCP/IP. You should expect this event when a computer restarts or when a previously disabled network adaptor is re-enabled. No user action is required.\"\tInformation\tMicrosoft-Windows-SmbClient/Connectivity\tMicrosoft-Windows-SMBClient\n05.09.2026 08:29:04.946\t1003\t\"The Software Protection service has completed licensing status check.\nApplication Id=55c92734-d682-4d71-983e-d6ec3f16059f\nLicensing Status=\n1: 01eb852c-424d-4060-94b8-c10d799d7364, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n2: 040fa323-92b1-4baf-97a2-5b67feaefddb, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n3: 0724cb7d-3437-4cb7-93cb-830375d0079d, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n4: 0ad2ac98-7bb9-4201-8d92-312299201369, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n5: 19de9b2f-0166-4abb-9534-56ea69a80edb, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n6: 1a9a717a-cf13-4ba5-83c3-0fe25fa868d5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n7: 221a02da-e2a1-4b75-864c-0a4410a33fdf, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n8: 265f3fad-6a1c-4bdd-ae30-c75efa556ccb, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n9: 291ece0e-9c38-40ca-a9e1-32cc7ec19507, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n10: 2936d1d2-913a-4542-b54e-ce5a602a2a38, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n11: 2c293c26-a45a-4a2a-a350-c69a67097529, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n12: 2de67392-b7a7-462a-b1ca-108dd189f588, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n13: 2ffd8952-423e-4903-b993-72a1aa44cf82, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n14: 30a42c86-b7a0-4a34-8c90-ff177cb2acb7, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n15: 345a5db0-d94f-4e3b-a0c0-7c42f7bc3ebf, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n16: 3502365a-f88a-4ba4-822a-5769d3073b65, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n17: 377333b1-8b5d-48d6-9679-1225c872d37c, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n18: 3df374ef-d444-4494-a5a1-4b0d9fd0e203, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n19: 3ebce241-ea87-4946-8a4f-80d00e921dff, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n20: 3f1afc82-f8ac-4f6c-8005-1d233e606eee, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n21: 4322a811-697c-44dc-865e-3e2fdcb86009, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n22: 49cd895b-53b2-4dc4-a5f7-b18aa019ad37, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n23: 4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c, 1, 1 [(0 )(1 )(2 [0x00000000, 1, 0], [(?)( 1 0x00000000)(?)(?)(?)(?)( 10 0x00000000 msft:rm/algorithm/flags/1.0)(?)])(3 )]\n24: 4f3da0d2-271d-4508-ae81-626b60809a38, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n25: 5d78c4e9-aeb3-4b40-8ac2-6a6005e0ad6d, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n26: 60b3ec1b-9545-4921-821f-311b129dd6f6, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n27: 613d217f-7f13-4268-9907-1662339531cd, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n28: 62f0c100-9c53-4e02-b886-a3528ddfe7f6, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n29: 6365275e-368d-46ca-a0ef-fc0404119333, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n30: 721f9237-9341-4453-a661-09e8baa6cca5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n31: 73111121-5638-40f6-bc11-f1d7b0d64300, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n32: 7a802526-4c94-4bd1-ba14-835a1aca2120, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n33: 7cb546c0-c7d5-44d8-9a5c-69ecdd782b69, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n34: 80083eae-7031-4394-9e88-4901973d56fe, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n35: 82bbc092-bc50-4e16-8e18-b74fc486aec3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n36: 8ab9bdd1-1f67-4997-82d9-8878520837d9, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n37: 8b351c9c-f398-4515-9900-09df49427262, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n38: 90da7373-1c51-430b-bf26-c97e9c5cdc31, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n39: 92fb8726-92a8-4ffc-94ce-f82e07444653, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n40: 95dca82f-385d-4d39-b85b-5c73fa285d6f, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n41: 97cde3ae-e908-4b59-ac96-a17645c5b57e, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n42: a48938aa-62fa-4966-9d44-9f04da3f72f2, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n43: b0773a15-df3a-4312-9ad2-83d69648e356, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n44: b4bfe195-541e-4e64-ad23-6177f19e395e, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n45: b68e61d2-68ca-4757-be45-0cc2f3e68eee, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n46: bd3762d7-270d-4760-8fb3-d829ca45278a, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n47: c86d5194-4840-4dae-9c1c-0301003a5ab0, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n48: ca7df2e3-5ea0-47b8-9ac1-b1be4d8edd69, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n49: d552befb-48cc-4327-8f39-47d2d94f987c, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n50: d6eadb3b-5ca8-4a6b-986e-35b550756111, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n51: df96023b-dcd9-4be2-afa0-c6c871159ebe, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n52: e0c42288-980c-4788-a014-c080d2e1926e, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n53: e4db50ea-bda1-4566-b047-0ca50abc6f07, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n54: e558417a-5123-4f6f-91e7-385c1c7ca9d4, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n55: e7a950a2-e548-4f10-bf16-02ec848e0643, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n56: eb6d346f-1c60-4643-b960-40ec31596c45, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n57: ec868e65-fadf-4759-b23e-93fe37f2cc29, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n58: ef51e000-2659-4f25-8345-3de70a9cf4c4, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n59: f7af7d09-40e4-419c-a49b-eae366689ebd, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n60: fa755fe6-6739-40b9-8d84-6d0ea3b6d1ab, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n61: fe74f55b-0338-41d6-b267-4a201abe7285, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n\n\"\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 08:29:04.947\t1040\tReceived Mib notification type MibAddInstance for interface 9\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:29:04.947\t1034\tSend RDMA Endpoint notification failure - DadState is different from IpDadStatePreferred for interface 9. Current DadState: 3.\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:29:04.949\t11000\t\"Wireless network association started.\n\nNetwork Adapter: Intel(R) Wi-Fi 6 AX201 160MHz\nInterface GUID: {449f824d-2856-4717-a3a7-cf59faac817a}\nLocal MAC Address: 28:92:00:F2:4A:95\nNetwork SSID: HUAWEI_HG8245_WiFi\nBSS Type: Infrastructure\nAuthentication: WPA2-Personal\nEncryption: AES-GCMP-128\n802.1X Enabled: No\n\"\tInformation\tMicrosoft-Windows-WLAN-AutoConfig/Operational\tMicrosoft-Windows-WLAN-AutoConfig\n05.09.2026 08:29:04.970\t9653\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:04.973\t9653\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:04.973\t9653\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.005\t7021\t7021 - Wi-Fi Driver Info\tInformation\tSystem\tNetwtw14\n05.09.2026 08:29:05.022\t4001\tEntered State: Identifying Network Interface Guid: {449f824d-2856-4717-a3a7-cf59faac817a}\tInformation\tMicrosoft-Windows-NetworkProfile/Operational\tMicrosoft-Windows-NetworkProfile\n05.09.2026 08:29:05.023\t20002\t\"NSI Set Category Result\n\tProfile GUID: {ffffffff-ffff-ffff-ffff-ffffffffffff}\n\tInterface GUID: {449f824d-2856-4717-a3a7-cf59faac817a}\n\tNetwork Category: Public\n\tIPv4 Error Code: 0\n\tIPv6 Error Code: 1168\n\tContext: 3275\n\"\tInformation\tMicrosoft-Windows-NetworkProfile/Operational\tMicrosoft-Windows-NetworkProfile\n05.09.2026 08:29:05.023\t10000\t\"Network Connected\n\tName: \u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u044f...\n\tDesc: \u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u044f...\n\tType: Unmanaged\n\tState: Connected\n\tCategory: Public\n\"\tInformation\tMicrosoft-Windows-NetworkProfile/Operational\tMicrosoft-Windows-NetworkProfile\n05.09.2026 08:29:05.027\t11001\t\"Wireless network association succeeded.\n\nNetwork Adapter: Intel(R) Wi-Fi 6 AX201 160MHz\nInterface GUID: {449f824d-2856-4717-a3a7-cf59faac817a}\nLocal MAC Address: 28:92:00:F2:4A:95\nNetwork SSID: HUAWEI_HG8245_WiFi\nBSS Type: Infrastructure\nManagement Frame Protection Enabled: 0x100000000\n\"\tInformation\tMicrosoft-Windows-WLAN-AutoConfig/Operational\tMicrosoft-Windows-WLAN-AutoConfig\n05.09.2026 08:29:05.027\t11010\t\"Wireless security started.\n\nNetwork Adapter: Intel(R) Wi-Fi 6 AX201 160MHz\nInterface GUID: {449f824d-2856-4717-a3a7-cf59faac817a}\nLocal MAC Address: 28:92:00:F2:4A:95\nNetwork SSID: HUAWEI_HG8245_WiFi\nBSS Type: Infrastructure\nAuthentication: WPA2-Personal\nEncryption: AES-GCMP-128\nFIPS Mode: Disabled\n802.1x Enabled: No\n\"\tInformation\tMicrosoft-Windows-WLAN-AutoConfig/Operational\tMicrosoft-Windows-WLAN-AutoConfig\n05.09.2026 08:29:05.036\t11005\t\"Wireless security succeeded.\n\nNetwork Adapter: Intel(R) Wi-Fi 6 AX201 160MHz\nInterface GUID: {449f824d-2856-4717-a3a7-cf59faac817a}\nLocal MAC Address: 28:92:00:F2:4A:95\nNetwork SSID: HUAWEI_HG8245_WiFi\nBSS Type: Infrastructure\n\"\tInformation\tMicrosoft-Windows-WLAN-AutoConfig/Operational\tMicrosoft-Windows-WLAN-AutoConfig\n05.09.2026 08:29:05.042\t902\t\"The Software Protection service has started.\n10.0.26100.9168\"\tUndefined\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 08:29:05.043\t2010\t\"Network profile changed on an interface.\n\nAdapter GUID:\t{449f824d-2856-4717-a3a7-cf59faac817a}\nAdapter Name:\twireless_32768\nOld Profile:\tNone\nNew Profile:\tPublic\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:29:05.062\t4205\tGateway resolution failed on interface {449f824d-2856-4717-a3a7-cf59faac817a} for 192.168.100.1 with error: 0x43\tError\tMicrosoft-Windows-NlaSvc/Operational\tMicrosoft-Windows-NlaSvc\n05.09.2026 08:29:05.080\t8001\t\"WLAN AutoConfig service has successfully connected to a wireless network.\n\nNetwork Adapter: Intel(R) Wi-Fi 6 AX201 160MHz\nInterface GUID: {449f824d-2856-4717-a3a7-cf59faac817a}\nConnection Mode: \u0410\u0432\u0442\u043e\u043c\u0430\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0435 \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435 \u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c \u043f\u0440\u043e\u0444\u0438\u043b\u044f\nProfile Name: HUAWEI_HG8245_WiFi\nSSID: HUAWEI_HG8245_WiFi\nBSS Type: Infrastructure\nPHY Type: 802.11n\nAuthentication: WPA2-Personal\nEncryption: AES-CCMP\n802.1x Enabled: No\nHidden: false\n\"\tInformation\tMicrosoft-Windows-WLAN-AutoConfig/Operational\tMicrosoft-Windows-WLAN-AutoConfig\n05.09.2026 08:29:05.174\t17\tThe Trusted Platform Module (TPM) hardware failed to execute a TPM command.\tInformation\tSystem\tTPM\n05.09.2026 08:29:05.176\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Platform Crypto Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.189\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Platform Crypto Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.193\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Platform Crypto Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.198\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Platform Crypto Provider\n \tKey Name:\tWindows AIK\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.198\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Platform Crypto Provider\n \tKey Name:\tWindows AIK\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090011\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.198\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Platform Crypto Provider\n \tKey Name:\tWindows AIK\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090011\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.253\t4\tThe maximum file size for session \"ReadyBoot\" has been reached. As a result, events might be lost (not logged) to file \"C:\\WINDOWS\\Prefetch\\ReadyBoot\\ReadyBoot.etl\". The maximum files size is currently set to 20971520 bytes.\tWarning\tMicrosoft-Windows-Kernel-EventTracing/Admin\tMicrosoft-Windows-Kernel-EventTracing\n05.09.2026 08:29:05.253\t3\tSession \"ReadyBoot\" stopped due to the following error: 0xC0000188\tError\tMicrosoft-Windows-Kernel-EventTracing/Admin\tMicrosoft-Windows-Kernel-EventTracing\n05.09.2026 08:29:05.260\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t17\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.271\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.271\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.271\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.271\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.271\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.271\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.272\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.272\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.272\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.273\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.273\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.273\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.273\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.273\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.304\t17\tThe Trusted Platform Module (TPM) hardware failed to execute a TPM command.\tInformation\tSystem\tTPM\n05.09.2026 08:29:05.305\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Platform Crypto Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.309\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Platform Crypto Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.312\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Platform Crypto Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.440\t4004\t\"Network State Change Fired\n\tNew Internet Connection Profile: true\n\tConnection Cost Changed: true\n\tDomain Connectivity Level Changed: false\n\tNetwork Connectivity Level Changed: true\n\tHost Name Changed: true\n\tWwan Registration State Changed: false\n\tTethering Operational State Changed: false\n\tTethering Client Count Changed: false\"\tInformation\tMicrosoft-Windows-NetworkProfile/Operational\tMicrosoft-Windows-NetworkProfile\n05.09.2026 08:29:05.468\t1024\tInternet connection status changed to false, submitting pending workitems: count = 1.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:05.472\t157\tThe license with Id 2da6ca43-2e6f-1f16-05ad-a9959043ddb7 has been archived successfully.  PFM if available: Microsoft.Windows.99.X20-15863_8wekyb3d8bbwe\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 08:29:05.472\t116\t\"Application license successfully installed.\nPackage: Microsoft.Windows.99.X20-15863_8wekyb3d8bbwe\nUser Id (if available): NULL\nLicense Id: 2da6ca43-2e6f-1f16-05ad-a9959043ddb7\nAssociate Id: 2da6ca43-2e6f-1f16-05ad-a9959043ddb7\"\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 08:29:05.496\t8000\t\"Process Name: C:\\WINDOWS\\System32\\svchost.exe\nModule Name: c:\\windows\\system32\\LicenseManager.dll\nBuild: 26100.1.amd64fre.ge_release.240331-1435\n\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.496\t8001\t\"Failure Message: Setting MSA Client Id for Token requests: {f0c62012-2cef-4831-b1f7-930682874c86}\nFunction: \nSource: onecoreuap\\enduser\\winstore\\auth\\lib\\winstoreauth.cpp (206)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.497\t8001\t\"License Manager starting...\nFunction: ServiceInitializeImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2113)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.497\t8001\t\"Creating LM\nFunction: CreateLicenseManager\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\manager.cpp (609)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.498\t8001\t\"0000021F83133E50: Root Machine\nFunction: RootMachine::RootMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\rootmachine.cpp (63)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.498\t8001\t\"License Manager started\nFunction: ServiceInitializeImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2141)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.499\t9649\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.499\t9648\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.502\t9649\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.502\t9648\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.502\t9649\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.502\t9648\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.508\t8001\t\"Licensing content 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: OneStoreApplicationLicenseManager::ActivateLicenseForContent\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\onestoreapplicensemanager.cpp (410)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.508\t8001\t\"Licensing 807d73a3-33f2-c21b-c47a-85c313d97af9 (Active)\nFunction: LicenseManager::LicenseContentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\manager.cpp (88)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.515\t2415\tAn application was unregistered with the following parameters: Microsoft.Explorer.Notification.{EC5FD88D-8E3A-9F78-2E20-67FB34BE9AFA} [AppUserModelId] The operation completed successfully. [ErrorCode]\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:05.520\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:05.520\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:05.537\t9649\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.537\t9648\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.539\t8001\t\"Network connectivity level initialized to 0x1\nFunction: NetworkStatusMonitor::Initialize\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\networkstatusmonitor.cpp (57)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.539\t8002\t\"Capturing identity for LocalSystem, this probably isn't intended\nFunction: StoredIdentity::StoredIdentity\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\identity.cpp (536)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.540\t8001\t\"0000021F8316EE20: Key Machine for content: 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: KeyMachine::KeyMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (95)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.540\t8011\t0x21f83133e68: 13668: RootMachine: Dispatch: Root:Connect => Root:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.540\t8001\t\"0000021F83133E50: BeginRootLicense\nFunction: RootMachine::DoBeginRootLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\rootmachine.cpp (201)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.540\t8012\t0x21f83133e68: 13668: Root:Initial Change: Root:Negotiating => RootMachine\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.540\t8011\t0x21f8316ee40: 13668: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:Activate => Key:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.540\t8001\t\"0000021F8316EE20: BeginLicense: Operation 3, CachedLeaseOK true, RequireServiceValidation false\nFunction: KeyMachine::DoBeginLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (819)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.540\t8012\t0x21f8316ee40: 13668: Key:Initial Change: Key:NegotiatingUnleased => 807d73a3-33f2-c21b-c47a-85c313d97af9\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.540\t8011\t0x21f83133e68: 13668: RootMachine: Dispatch: Root:@LicenseDone => Root:Negotiating\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.540\t8012\t0x21f83133e68: 13668: Root:Negotiating Change: Root:Valid => RootMachine\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.543\t8001\t\"Considering License ID {2DA6CA43-2E6F-1F16-05AD-A9959043DDB7} for content ID 807d73a3-33f2-c21b-c47a-85c313d97af9...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.543\t8001\t\"Accepting key with License ID {2DA6CA43-2E6F-1F16-05AD-A9959043DDB7} for Content ID 807d73a3-33f2-c21b-c47a-85c313d97af9 (first match)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (223)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.543\t8001\t\"Considering License ID {8CB56148-398C-A7C4-98F2-6FDC89C2093D} for content ID 807d73a3-33f2-c21b-c47a-85c313d97af9...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.543\t8001\t\"Ignoring key for 807d73a3-33f2-c21b-c47a-85c313d97af9 with quality fffffff (0xc0ea0009) (no better than best)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (251)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.543\t8001\t\"Considering License ID {BDBB3CA5-594E-7337-A093-A9860F553465} for content ID 807d73a3-33f2-c21b-c47a-85c313d97af9...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.543\t8001\t\"Decoding: {}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.543\t8001\t\"Accepting key with License ID {BDBB3CA5-594E-7337-A093-A9860F553465} for Content ID 807d73a3-33f2-c21b-c47a-85c313d97af9 (better quality: 7f000000 vs 1fffffff)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (229)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.543\t8001\t\"Returning key document for contentid 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (262)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.543\t8001\t\"Getting lease for 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: LicenseManagerCore::GetExistingLeaseAndLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (415)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.547\t8001\t\"Ignoring otherwise matching lease ({33B013F2-4858-241D-9000-CA9374B3ADB5}) for Content ID 807D73A3-33F2-C21B-C47A-85C313D97AF9 because of quality 268435455 (0xc0ea000a)\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (396)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.547\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.547\t8001\t\"Adding lease {AE9143F3-8179-89B2-A3AF-FFC1D366D1AE} to results\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (387)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.547\t8001\t\"Returning 1 lease documents for contentid 807D73A3-33F2-C21B-C47A-85C313D97AF9\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.548\t8001\t\"lease = 0x8316b288, usage = 536870912, policy = 2147483647, operation = 3, leaseBehavior = 0, shouldContentBeDeactivated = 0\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (905)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.548\t8001\t\"lease = 0x8316b288, quality = 1073741824\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (935)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.548\t8001\t\"content is alreadyLicensed, lease is cached\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (942)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.548\t8011\t0x21f8316ee40: 13728: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:@LicenseDone => Key:NegotiatingUnleased\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.549\t9649\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.549\t9648\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.549\t9652\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.549\t9652\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.552\t8002\t\"Failure Message: hr: 0x80070490\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\misc.cpp (49)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.552\t8001\t\"lease = 0x8316b288, leaseActive = 1, leaseBehavior = 0\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1986)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.552\t8001\t\"Lease Machine: 0000021F8312BD00: {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: LeaseMachine::LeaseMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (40)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.552\t8001\t\"Set results for lease = 0x8316b288, policy = 2147483647, operation = 3, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.552\t8011\t0x21f8312bd20: 13732: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:UpdateLeaseDocument => Lease:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.552\t8012\t0x21f8312bd20: 13732: Lease:Initial Change: Lease:Valid => {2CE050AC-4159-AABB-AC60-9CED070AF672}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.552\t8001\t\"No cached lease or key found, not renewing with service and treating this as a valid license with lease = 0x8316b288\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (2032)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.552\t8012\t0x21f8316ee40: 13728: Key:NegotiatingUnleased Change: Key:Valid => 807d73a3-33f2-c21b-c47a-85c313d97af9\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.552\t8001\t\"Decoding: {}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.552\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.552\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.553\t8011\t0x21f8316ee40: 13680: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:RegisterCallback => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.554\t8011\t0x21f8316ee40: 13668: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:Unregistered => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.554\t8001\t\"Lease dropped\nFunction: KeyMachine::DoDropLease\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (279)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.554\t8012\t0x21f8316ee40: 13668: Key:Valid Change: Key:Invalid => 807d73a3-33f2-c21b-c47a-85c313d97af9\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.554\t8001\t\"Set results for lease = 0x0, policy = 0, operation = 0, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.554\t8001\t\"Updating lease timer for {2CE050AC-4159-AABB-AC60-9CED070AF672} to expire @ 2026-09-11T13:58:38Z (jitter was 35.978432 minutes)\nFunction: LeaseMachine::DoUpdateLeaseTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (276)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.554\t8001\t\"Added timer for {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: MemoryTimerService::CreateTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (57)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.554\t8011\t0x21f8312bd20: 13732: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:AddKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.554\t8011\t0x21f8312bd20: 13732: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:RemoveKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.554\t8011\t0x21f8312bd20: 13732: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:Unregistered => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.554\t8012\t0x21f8312bd20: 13732: Lease:Valid Change: Lease:Invalid => {2CE050AC-4159-AABB-AC60-9CED070AF672}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.554\t8001\t\"Requesting lease document removal for reason 0x00000000, {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: LicenseManagerCore::DoRemoveLeaseDocumentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (1460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.555\t173\tProduct key from MSDM table redeemed. Result: 0x0\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 08:29:05.556\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.556\t8001\t\"Ignoring lease removal with reason 0x00000000 because this is an offline lease\n\nFunction: ClipStorage::RemoveLeaseDocumentWithIdAndReason\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (501)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.556\t8002\t\"Trying to remove timer {2CE050AC-4159-AABB-AC60-9CED070AF672} not in table\nFunction: MemoryTimerService::CancelTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (80)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.556\t8001\t\"Removed timer for {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: MemoryTimerService::CleanupTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (19)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.560\t9653\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.570\t17\tThe Trusted Platform Module (TPM) hardware failed to execute a TPM command.\tInformation\tSystem\tTPM\n05.09.2026 08:29:05.574\t603\tStarted deployment SetDefaultVolumeOperation operation on a package with main parameter  and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:05.580\t603\tStarted deployment SetMutablePackagesOnlineOperation operation on a package with main parameter  and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:05.582\t9653\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.583\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Platform Crypto Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.596\t811\tThe winlogon notification subscriber  began handling the notification event (14).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:29:05.597\t812\tThe winlogon notification subscriber  finished handling the notification event (14).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:29:05.615\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Platform Crypto Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.621\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Platform Crypto Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.630\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Platform Crypto Provider\n \tKey Name:\tWindowsAIK_ECC_TPM_ECC_NIST_P256\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090011\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.630\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Platform Crypto Provider\n \tKey Name:\tWindowsAIK_ECC_TPM_ECC_NIST_P256\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090011\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.649\t3000\tTile session creation is requested for C:\\Windows\\explorer.exe endpoint 0x0.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:05.649\t3001\tTile session creation is finished for C:\\Windows\\explorer.exe from endpoint 0x0 with result The operation completed successfully., and 2 is assigned as session id. Queued Closes = 0, Queued Cleanups = 0\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:05.658\t9649\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.658\t9648\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.707\t1001\tFor internal use only.\tInformation\tMicrosoft-Windows-Storsvc/Diagnostic\tMicrosoft-Windows-Storsvc\n05.09.2026 08:29:05.737\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t17\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.749\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.749\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.749\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.749\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.750\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.750\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.750\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.750\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.750\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.750\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.750\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.751\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.751\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.751\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.773\t17\tThe Trusted Platform Module (TPM) hardware failed to execute a TPM command.\tInformation\tSystem\tTPM\n05.09.2026 08:29:05.774\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Platform Crypto Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.778\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Platform Crypto Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.802\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Platform Crypto Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.811\t9708\tFinished execution of command 'setup.exe\" --msedgewebview --delete-old-versions --system-level --verbose-logging --on-logon' (PID 9072).\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.811\t9706\tFinished enumeration of commands for registry key 'Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce'.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.811\t9704\tRunOnce commands finished.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.821\t1025\tThe TPM was successfully provisioned and is now ready for use.\tInformation\tSystem\tMicrosoft-Windows-TPM-WMI\n05.09.2026 08:29:05.835\t8001\t\"Skipping license manager: PFN Microsoft.YourPhone_1.26071.164.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.870\t210\tCreated Desktop AppX container {245CDB4D-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.YourPhone_1.26071.164.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:05.870\t211\tAdded process 13892 to Desktop AppX container 245cdb4d-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.YourPhone_1.26071.164.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:05.895\t505\t\"Compatibility fix applied to C:\\Program Files\\WindowsApps\\Microsoft.YourPhone_1.26071.164.0_x64__8wekyb3d8bbwe\\PhoneExperienceHost.exe.\nFix information: Microsoft Apps, {81ecdb97-5112-41af-9a59-5ba9444f4270}, 0x80010101.\"\tInformation\tMicrosoft-Windows-Application-Experience/Program-Telemetry\tMicrosoft-Windows-Application-Experience\n05.09.2026 08:29:06.386\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.388\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.388\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.390\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.392\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p -s wlidsvc( #0x0/0x11272 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:29:06.394\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.424\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.424\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.453\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.453\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.454\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.528\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.530\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.530\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.532\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.534\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p -s wlidsvc( #0x0/0x11272 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:29:06.536\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.566\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.567\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.597\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.598\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.598\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:07.382\t16\tCounter 11 of instance ({00000000-0000-0000-0000-000000000000}, NULL, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:07.382\t16\tCounter 6 of instance ({00000000-0000-0000-0000-000000000000}, NULL, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:07.711\t15\t\"New client uses VBS Key Isolation\nName: msedgewebview2.exe\nBinding status: 0x80090039 (VBS key isolation is not available.)\nClient instance binding attempts: 1\n\"\tInformation\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:07.711\t25\tVBS Key Isolation status: Could not connect\tInformation\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:07.711\t4\t\"Create Key operation failed.\n\n Cryptographic Parameters:\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tChromeMetricsTestKey\n \tAlgorithm Name:\tECDSA_P256\n \tFlags:\t\t0x20000\n Failure Information:\n  \tReturn Code:\t0x80090039\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:08.310\t1040\tReceived Mib notification type MibParameterNotification for interface 7\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:29:08.310\t1034\tSend RDMA Endpoint notification failure - Error getting unicast ip address entry for interface 7. The object was not found.\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:29:08.312\t30811\t\"Deleted a TCP/IP transport interface.\n\nName: \u0411\u0435\u0441\u043f\u0440\u043e\u0432\u043e\u0434\u043d\u0430\u044f \u0441\u0435\u0442\u044c\nInterfaceIndex: 0x7\n\nGuidance:\nA TCP/IP binding was removed from the specified network adapter for the SMB client. You should expect this event when a computer shuts down or when a previously enabled network adaptor is disabled. No user action is required.\"\tInformation\tMicrosoft-Windows-SmbClient/Connectivity\tMicrosoft-Windows-SMBClient\n05.09.2026 08:29:08.312\t1040\tReceived Mib notification type MibDeleteInstance for interface 7\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:29:08.312\t1033\tSent RDMA disabled event to LanmanServer for interface \\Device\\RdmaSmbIpv4_169.254.156.52.\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:29:08.312\t1034\tSend RDMA Endpoint notification failure - Error updating transport list for device \\Device\\RdmaSmbIpv4_169.254.156.52. Object Name not found..\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:29:08.314\t1040\tReceived Mib notification type MibParameterNotification for interface 7\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:29:08.344\t219\tPSMFlags for Desktop AppX process %1 with applicationID %2 is %3.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:08.360\t201\tCreated process 13720 for application Microsoft.OfficePushNotificationUtility_8wekyb3d8bbwe!OPushUtil in package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe. [FinishPackageActivation]\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:08.390\t30812\t\"Added a TDI transport interface.\n\nName: \\Device\\NetBT_Tcpip_{449F824D-2856-4717-A3A7-CF59FAAC817A}\n\nGuidance:\nA TDI (NetBIOS) binding was added to the specified network adapter for the SMB client. The SMB client can now send and receive SMB traffic on this network adapter using TDI. You should expect this event when a computer restarts or when a previously disabled network adaptor is re-enabled. No user action is required.\"\tInformation\tMicrosoft-Windows-SmbClient/Connectivity\tMicrosoft-Windows-SMBClient\n05.09.2026 08:29:08.406\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:08.490\t326\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1006.\tVerbose\tMicrosoft-Windows-AppXDeployment/Operational\tMicrosoft-Windows-AppXDeployment\n05.09.2026 08:29:08.495\t819\tThe following packages will be installed: . The following packages will be removed: \tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:08.546\t327\tThe following packages will be installed: NULL. The following packages will be removed: NULL\tVerbose\tMicrosoft-Windows-AppXDeployment/Operational\tMicrosoft-Windows-AppXDeployment\n05.09.2026 08:29:08.621\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.623\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.623\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.624\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.627\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p -s wlidsvc( #0x0/0x11272 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:29:08.628\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.673\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.674\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.704\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.705\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.705\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.726\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:08.726\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:08.763\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.765\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.765\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.767\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.769\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p -s wlidsvc( #0x0/0x11272 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:29:08.770\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.813\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.813\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.840\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.841\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.841\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:09.061\t6062\t6062 - Wi-Fi Driver Info\tWarning\tSystem\tNetwtw14\n05.09.2026 08:29:09.083\t4042\tCapability change on {449f824d-2856-4717-a3a7-cf59faac817a} (0x47008000000000 Family: V4 Capability: Internet ChangeReason: ActiveHttpProbeSucceeded)\tInformation\tMicrosoft-Windows-NCSI/Operational\tMicrosoft-Windows-NCSI\n05.09.2026 08:29:09.084\t56\tIs a free network available: true\tInformation\tMicrosoft-Windows-UniversalTelemetryClient/Operational\tMicrosoft-Windows-UniversalTelemetryClient\n05.09.2026 08:29:09.084\t55\tIs the Internet available: true\tInformation\tMicrosoft-Windows-UniversalTelemetryClient/Operational\tMicrosoft-Windows-UniversalTelemetryClient\n05.09.2026 08:29:09.114\t8001\t\"Skipping license manager: PFN Microsoft.WindowsStore_22606.1401.6.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:09.115\t8001\t\"Skipping license manager: PFN Microsoft.WindowsStore_22606.1401.6.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:09.219\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:09.239\t4002\tTransitioning to State: Identified Network Interface Guid: {449f824d-2856-4717-a3a7-cf59faac817a}\tInformation\tMicrosoft-Windows-NetworkProfile/Operational\tMicrosoft-Windows-NetworkProfile\n05.09.2026 08:29:09.242\t10000\t\"Network Connected\n\tName: HUAWEI_HG8245_WiFi\n\tDesc: HUAWEI_HG8245_WiFi\n\tType: Unmanaged\n\tState: Connected,IPV4 (Internet)\n\tCategory: Public\n\"\tInformation\tMicrosoft-Windows-NetworkProfile/Operational\tMicrosoft-Windows-NetworkProfile\n05.09.2026 08:29:09.277\t1113\tDevice Compact Ticket request completed with Device Id 00180018E4F8342E for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:09.281\t1254\tWNP Transport Layer for Data Connection detected preferred interface change. Old index 0, old address family 0. New index 7, new address family 2, NDIS_PHYSICAL_MEDIUM 9.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:09.293\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:09.313\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:09.313\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:09.365\t4004\t\"Network State Change Fired\n\tNew Internet Connection Profile: false\n\tConnection Cost Changed: false\n\tDomain Connectivity Level Changed: false\n\tNetwork Connectivity Level Changed: true\n\tHost Name Changed: true\n\tWwan Registration State Changed: false\n\tTethering Operational State Changed: false\n\tTethering Client Count Changed: false\"\tInformation\tMicrosoft-Windows-NetworkProfile/Operational\tMicrosoft-Windows-NetworkProfile\n05.09.2026 08:29:09.368\t8001\t\"Lease any offline running content after 1788571749 seconds\nFunction: NetworkStatusMonitor::Invoke\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\networkstatusmonitor.cpp (121)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:09.368\t8001\t\"Network connectivity level changed to 0x3\nFunction: NetworkStatusMonitor::Invoke\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\networkstatusmonitor.cpp (132)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:09.368\t8011\t0x21f83133e68: 13732: RootMachine: Dispatch: Root:EnsureAllKeysAndLeases => Root:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:09.368\t8001\t\"0000021F83133E50: BeginRootLicense\nFunction: RootMachine::DoBeginRootLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\rootmachine.cpp (201)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:09.368\t8012\t0x21f83133e68: 13732: Root:Valid Change: Root:Negotiating => RootMachine\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:09.368\t8011\t0x21f83133e68: 13732: RootMachine: Dispatch: Root:@LicenseDone => Root:Negotiating\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:09.368\t8012\t0x21f83133e68: 13732: Root:Negotiating Change: Root:Valid => RootMachine\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:09.369\t1024\tInternet connection status changed to true, submitting pending workitems: count = 1.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:09.372\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:09.376\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:09.380\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:09.543\t1002\tError 0x80070005 occurred while verifying known folder {62ab5d82-fdc1-4dc3-a9dd-070d1d495d97} with path 'C:\\ProgramData'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:29:11.062\t2003\tWindows 10 Pro6.3262002009windows-11-25h2-6426.2.0.7DSAClientCore.dllDSAClientCore.Controllers.Rules.RulesEngineAfterDeviceScanRulesEngineAfterDeviceScanExceptionGraphics: Object reference not set to an instance of an object.\tInformation\tApplication\tDSAService\n05.09.2026 08:29:11.064\t2003\tWindows 10 Pro6.3262002009windows-11-25h2-6426.2.0.7DSAClientCore.dllDSAClientCore.Controllers.Session.PopulateSessionControllerSetComputerDataStaleDeviceDataFallback\tInformation\tApplication\tDSAService\n05.09.2026 08:29:11.068\t2003\tWindows 10 Pro6.3262002009windows-11-25h2-6426.2.0.7DSAClientCore.dllDSAClientCore.Controllers.Session.PopulateSessionControllerSetComputerDataStaleStorageDeviceDataFallback\tInformation\tApplication\tDSAService\n05.09.2026 08:29:11.080\t2003\tWindows 10 Pro6.3262002009windows-11-25h2-6426.2.0.7DSAClientCore.dllDSAClientCore.Controllers.Session.PopulateSessionControllerSetOemSupportDetailsUnknownOemHONOR/HONOR\tInformation\tApplication\tDSAService\n05.09.2026 08:29:11.318\t30810\t\"Added a TCP/IP transport interface.\n\nName: \u041f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435 \u043f\u043e \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u0439 \u0441\u0435\u0442\u0438* 9\nInterfaceIndex: 0x9\n\nGuidance:\nA TCP/IP binding was added to the specified network adapter for the SMB client. The SMB client can now send and receive SMB traffic on this network adapter using TCP/IP. You should expect this event when a computer restarts or when a previously disabled network adaptor is re-enabled. No user action is required.\"\tInformation\tMicrosoft-Windows-SmbClient/Connectivity\tMicrosoft-Windows-SMBClient\n05.09.2026 08:29:11.319\t1040\tReceived Mib notification type MibAddInstance for interface 9\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:29:11.319\t1034\tSend RDMA Endpoint notification failure - DadState is different from IpDadStatePreferred for interface 9. Current DadState: 1.\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:29:11.415\t1010\t\"Endpoint added.\n\nName: HONOR-FRG-X     \nDomain Name: WORKGROUP\nTransport Name: \\Device\\NetBT_Tcpip_{449F824D-2856-4717-A3A7-CF59FAAC817A}\nTransport Flags: 0x1\n\nGuidance:\n\nYou should expect this event when the server starts listening on an interface, such as during system restart or when enabling a network adaptor. No user action is required.\"\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:29:12.853\t5007\t\"\u0410\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043d\u0430\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430 Microsoft Defender Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.\n \tOld value: HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\Diagnostics\\ProtectionManagementMofHash = a4f0455797da589699c88048c9055208884c9ae1a24e5783028173202684753e\n \tNew value: HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\Diagnostics\\ProtectionManagementMofHash = 38eb3b5d90c1abdb84dc50dd0a18c5d6dec582c62c4ac821c09984d2a9b98ae8\"\tInformation\tMicrosoft-Windows-Windows Defender/Operational\tMicrosoft-Windows-Windows Defender\n05.09.2026 08:29:12.853\t5007\t\"\u0410\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043d\u0430\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430 Microsoft Defender Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.\n \tOld value: HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\Diagnostics\\InitializingComponentProgress = LoadingEngine\n \tNew value: HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\Diagnostics\\InitializingComponentProgress = ServiceStartedSuccessfully\"\tInformation\tMicrosoft-Windows-Windows Defender/Operational\tMicrosoft-Windows-Windows Defender\n05.09.2026 08:29:12.856\t5007\t\"\u0410\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043d\u0430\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430 Microsoft Defender Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.\n \tOld value: HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\Features\\Controls\\301 = 0x2710\n \tNew value: \"\tInformation\tMicrosoft-Windows-Windows Defender/Operational\tMicrosoft-Windows-Windows Defender\n05.09.2026 08:29:12.856\t5007\t\"\u0410\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043d\u0430\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430 Microsoft Defender Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.\n \tOld value: HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\Features\\Controls\\282 = 0x1\n \tNew value: \"\tInformation\tMicrosoft-Windows-Windows Defender/Operational\tMicrosoft-Windows-Windows Defender\n05.09.2026 08:29:12.856\t5007\t\"\u0410\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043d\u0430\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430 Microsoft Defender Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.\n \tOld value: HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\Features\\Controls\\290 = 0x1\n \tNew value: \"\tInformation\tMicrosoft-Windows-Windows Defender/Operational\tMicrosoft-Windows-Windows Defender\n05.09.2026 08:29:12.939\t28017\tAppResolver Scan Started.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:13.000\t28018\tAppResolver Scan Stopped.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:13.002\t28019\tAppResolver Cache Committed.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:13.005\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:13.372\t171\tThe reader was created successfully for app package inputsuggestions_8.1002.26168.2_neutral_neutral_8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppxPackaging/Operational\tMicrosoft-Windows-AppxPackagingOM\n05.09.2026 08:29:14.362\t9705\tStarted enumeration of commands for registry key 'Software\\Microsoft\\Windows\\CurrentVersion\\Run'.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:14.362\t9707\tStarted execution of command 'RtkAudUService64.exe\" -background'.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:14.804\t9708\tFinished execution of command 'RtkAudUService64.exe\" -background' (PID 12628).\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:14.804\t9706\tFinished enumeration of commands for registry key 'Software\\Microsoft\\Windows\\CurrentVersion\\Run'.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:14.805\t9705\tStarted enumeration of commands for registry key 'Software\\Microsoft\\Windows\\CurrentVersion\\Run'.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:14.805\t9707\tStarted execution of command 'chrome.exe\" --no-startup-window /prefetch:5'.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:15.137\t5058\t\"Key file operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nProcess Information:\n\tProcess ID:\t\t14420\n\tProcess Creation Time:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:29:15.109934300Z\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tUNKNOWN\n\tKey Name:\tGoogle Chromekey1\n\tKey Type:\tUser key.\n\nKey File Operation Information:\n\tFile Path:\tC:\\ProgramData\\Microsoft\\Crypto\\SystemKeys\\7096db7aeb75c0d3497ecd56d355a695_aae0f96c-9dfa-4728-bee3-a8368e406b6b\n\tOperation:\tRead persisted key from file.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:15.137\t5061\t\"Cryptographic operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tAES\n\tKey Name:\tGoogle Chromekey1\n\tKey Type:\tUser key.\n\nCryptographic Operation:\n\tOperation:\tOpen Key.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:16.419\t4004\t\"Network State Change Fired\n\tNew Internet Connection Profile: false\n\tConnection Cost Changed: false\n\tDomain Connectivity Level Changed: false\n\tNetwork Connectivity Level Changed: false\n\tHost Name Changed: true\n\tWwan Registration State Changed: false\n\tTethering Operational State Changed: false\n\tTethering Client Count Changed: false\"\tInformation\tMicrosoft-Windows-NetworkProfile/Operational\tMicrosoft-Windows-NetworkProfile\n05.09.2026 08:29:16.423\t1024\tInternet connection status changed to true, submitting pending workitems: count = 0.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:16.532\t5058\t\"Key file operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nProcess Information:\n\tProcess ID:\t\t14976\n\tProcess Creation Time:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:29:16.492661000Z\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tUNKNOWN\n\tKey Name:\tGoogle Chromekey1\n\tKey Type:\tUser key.\n\nKey File Operation Information:\n\tFile Path:\tC:\\ProgramData\\Microsoft\\Crypto\\SystemKeys\\7096db7aeb75c0d3497ecd56d355a695_aae0f96c-9dfa-4728-bee3-a8368e406b6b\n\tOperation:\tRead persisted key from file.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:16.532\t5061\t\"Cryptographic operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tAES\n\tKey Name:\tGoogle Chromekey1\n\tKey Type:\tUser key.\n\nCryptographic Operation:\n\tOperation:\tOpen Key.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:16.536\t4\t\"Create Key operation failed.\n\n Cryptographic Parameters:\n \tProvider Name:\tMicrosoft Passport Key Storage Provider\n \tKey Name:\tS-1-5-21-3712849175-2219398513-4278588552-1006//S-1-5-21-3712849175-2219398513-4278588552-1006//MSTestAvailability-FF2FA111-E816-4D1B-BDDD-65F189969E50\n \tAlgorithm Name:\tRSA\n \tFlags:\t\t0x0\n Failure Information:\n  \tReturn Code:\t0x80090016\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:18.100\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.100\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.116\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.116\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.291\t1005\tThe Connection Provider status changed to Disconnected.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.291\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.291\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.299\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.305\t1113\tDevice Compact Ticket request completed with Device Id 00180018E4F8342E for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.305\t1205\tWNP Transport Layer Disconnect call initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.306\t1264\tAdding new user to the Windows Push Notification Service completed. 00180018E4F8342E [DeviceId] 17056885 [UserId] 0x880403E8 [ErrorCode].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.306\t1005\tThe Connection Provider status changed to Disconnected.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.306\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.306\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.313\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.318\t1113\tDevice Compact Ticket request completed with Device Id 00180018E4F8342E for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.327\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.328\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.328\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.813\t1005\tThe Connection Provider status changed to Disconnected.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.813\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.813\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.821\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:19.251\t4\t\"Create Key operation failed.\n\n Cryptographic Parameters:\n \tProvider Name:\tMicrosoft Passport Key Storage Provider\n \tKey Name:\tS-1-5-21-3712849175-2219398513-4278588552-1006//S-1-5-21-3712849175-2219398513-4278588552-1006//MSTestAvailability-FF2FA111-E816-4D1B-BDDD-65F189969E50\n \tAlgorithm Name:\tRSA\n \tFlags:\t\t0x0\n Failure Information:\n  \tReturn Code:\t0x80090016\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:19.288\t15\t\"New client uses VBS Key Isolation\nName: chrome.exe\nBinding status: 0x0 (The operation completed successfully.)\nClient instance binding attempts: 1\n\"\tInformation\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:19.314\t5058\t\"Key file operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nProcess Information:\n\tProcess ID:\t\t14724\n\tProcess Creation Time:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:29:16.183171100Z\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tECDSA_P256\n\tKey Name:\tChromeMetricsTestKey\n\tKey Type:\tUser key.\n\nKey File Operation Information:\n\tFile Path:\tC:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Crypto\\Keys\\1e313dfb17707690d41bc1ce552b952a_aae0f96c-9dfa-4728-bee3-a8368e406b6b\n\tOperation:\tWrite persisted key to file.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:19.314\t9\t\"Key write succeeded.\n\n Provider Name:\tMicrosoft Software Key Storage Provider\n ModificationType: \t\t0x1\n Flags:\t\t0x1\n Key Name:\tChromeMetricsTestKey\n Key File Name:\t1e313dfb17707690d41bc1ce552b952a_aae0f96c-9dfa-4728-bee3-a8368e406b6b\n ProcessName:\tC:\\Program Files\\Google\\Chrome\\Application\\chrome.exe\n ProcessId:\t0x3984\n ServerThreadId:\t0x714\n UserId:\tS-1-5-21-3712849175-2219398513-4278588552-1006\n ServiceTag:\t\n Return Code:\t0x0\"\tVerbose\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:19.314\t21\t\"Key write succeeded.\n\n Provider Name:\tMicrosoft Software Key Storage Provider\n ModificationType: \t\t0x1\n Flags:\t\t0x1\n Key Name:\tChromeMetricsTestKey\n Key File Name:\t1e313dfb17707690d41bc1ce552b952a_aae0f96c-9dfa-4728-bee3-a8368e406b6b\n ProcessName:\tC:\\Program Files\\Google\\Chrome\\Application\\chrome.exe\n ProcessId:\t0x3984\n ServerThreadId:\t0x714\n UserId:\tS-1-5-21-3712849175-2219398513-4278588552-1006\n ServiceTag:\t\n Return Code:\t0x0\"\tInformation\tMicrosoft-Windows-Crypto-NCrypt/KeyMgmt\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:19.315\t5061\t\"Cryptographic operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tECDSA_P256\n\tKey Name:\tChromeMetricsTestKey\n\tKey Type:\tUser key.\n\nCryptographic Operation:\n\tOperation:\tCreate Key.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:19.315\t5059\t\"Key migration operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nProcess Information:\n\tProcess ID:\t\t14724\n\tProcess Creation Time:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:29:16.183171100Z\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tECDSA_P256\n\tKey Name:\tChromeMetricsTestKey\n\tKey Type:\tUser key.\n\nAdditional Information:\n\tOperation:\tExport of persistent cryptographic key.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:19.316\t5058\t\"Key file operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nProcess Information:\n\tProcess ID:\t\t14724\n\tProcess Creation Time:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:29:16.183171100Z\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tUNKNOWN\n\tKey Name:\tChromeMetricsTestKey\n\tKey Type:\tUser key.\n\nKey File Operation Information:\n\tFile Path:\tC:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Crypto\\Keys\\1e313dfb17707690d41bc1ce552b952a_aae0f96c-9dfa-4728-bee3-a8368e406b6b\n\tOperation:\tRead persisted key from file.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:19.327\t5061\t\"Cryptographic operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tECDSA_P256\n\tKey Name:\tChromeMetricsTestKey\n\tKey Type:\tUser key.\n\nCryptographic Operation:\n\tOperation:\tOpen Key.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:19.328\t5059\t\"Key migration operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nProcess Information:\n\tProcess ID:\t\t14724\n\tProcess Creation Time:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:29:16.183171100Z\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tECDSA_P256\n\tKey Name:\tChromeMetricsTestKey\n\tKey Type:\tUser key.\n\nAdditional Information:\n\tOperation:\tExport of persistent cryptographic key.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:19.333\t5058\t\"Key file operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nProcess Information:\n\tProcess ID:\t\t14724\n\tProcess Creation Time:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:29:16.183171100Z\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tECDSA_P256\n\tKey Name:\tChromeMetricsTestKey\n\tKey Type:\tUser key.\n\nKey File Operation Information:\n\tFile Path:\tC:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Crypto\\Keys\\1e313dfb17707690d41bc1ce552b952a_aae0f96c-9dfa-4728-bee3-a8368e406b6b\n\tOperation:\tDelete key file.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:19.336\t11\t\"Delete key succeeded.\n\n Provider Name:\tMicrosoft Software Key Storage Provider\n Flags:\t\t0x40\n DeletionType: \t\t0x0\n Key Name:\tChromeMetricsTestKey\n Key File Name:\t1e313dfb17707690d41bc1ce552b952a_aae0f96c-9dfa-4728-bee3-a8368e406b6b\n ProcessName:\tC:\\Program Files\\Google\\Chrome\\Application\\chrome.exe\n ProcessId:\t0x3984\n ServerThreadId:\t0x714\n UserId:\tS-1-5-21-3712849175-2219398513-4278588552-1006\n ServiceTag:\t\n Return Code:\t0x0\"\tVerbose\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:19.336\t22\t\"Delete key succeeded.\n\n Provider Name:\tMicrosoft Software Key Storage Provider\n Flags:\t\t0x40\n DeletionType: \t\t0x0\n Key Name:\tChromeMetricsTestKey\n Key File Name:\t1e313dfb17707690d41bc1ce552b952a_aae0f96c-9dfa-4728-bee3-a8368e406b6b\n ProcessName:\tC:\\Program Files\\Google\\Chrome\\Application\\chrome.exe\n ProcessId:\t0x3984\n ServerThreadId:\t0x714\n UserId:\tS-1-5-21-3712849175-2219398513-4278588552-1006\n ServiceTag:\t\n Return Code:\t0x0\"\tInformation\tMicrosoft-Windows-Crypto-NCrypt/KeyMgmt\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:23.346\t9708\tFinished execution of command 'chrome.exe\" --no-startup-window /prefetch:5' (PID 10840).\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:23.346\t9706\tFinished enumeration of commands for registry key 'Software\\Microsoft\\Windows\\CurrentVersion\\Run'.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:23.399\t62408\tStarted execution of command 'QuickShareLauncher.exe'.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:23.410\t8001\t\"canDisableApps value is 0\nFunction: InitStoreAppsAreDisabled\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (195)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.411\t8001\t\"Invoking license manager because license/lease polling time up: PFN SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (361)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.411\t8001\t\"ServiceBeginAcquireLicenseImpl PsmKey:SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy+LMV1xF00Dx7238, IsSystemUsage:0\nFunction: ServiceBeginAcquireLicenseImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2304)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.415\t8001\t\"Licensing package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy (3)\nFunction: OneStoreApplicationLicenseManager::GetLicenseForInstalledPackage\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\onestoreapplicensemanager.cpp (120)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.416\t8001\t\"Licensing 9CD2C66B-D3F2-3342-77A1-FDE6E819AC29 (Active)\nFunction: LicenseManager::LicenseContentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\manager.cpp (88)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.416\t8001\t\"0000021F83176B60: Key Machine for content: 9CD2C66B-D3F2-3342-77A1-FDE6E819AC29\nFunction: KeyMachine::KeyMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (95)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.416\t8011\t0x21f83133e68: 13668: RootMachine: Dispatch: Root:Connect => Root:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.416\t8011\t0x21f83176b80: 13732: 9CD2C66B-D3F2-3342-77A1-FDE6E819AC29: Dispatch: Key:Activate => Key:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.416\t8001\t\"0000021F83176B60: BeginLicense: Operation 3, CachedLeaseOK true, RequireServiceValidation false\nFunction: KeyMachine::DoBeginLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (819)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.416\t8012\t0x21f83176b80: 13732: Key:Initial Change: Key:NegotiatingUnleased => 9CD2C66B-D3F2-3342-77A1-FDE6E819AC29\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.419\t8001\t\"Considering License ID {E6AFC57E-E948-0700-1F5B-021330EC499E} for content ID 9CD2C66B-D3F2-3342-77A1-FDE6E819AC29...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.419\t8001\t\"Decoding: {\"\"legacyProductId\"\":\"\"998915e6-71dc-4fff-8a51-ec5d495514e9\"\"}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.419\t8001\t\"Accepting key with License ID {E6AFC57E-E948-0700-1F5B-021330EC499E} for Content ID 9CD2C66B-D3F2-3342-77A1-FDE6E819AC29 (first match)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (223)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.419\t8001\t\"Returning key document for contentid 9CD2C66B-D3F2-3342-77A1-FDE6E819AC29\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (262)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.419\t8001\t\"Getting lease for 9CD2C66B-D3F2-3342-77A1-FDE6E819AC29\nFunction: LicenseManagerCore::GetExistingLeaseAndLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (415)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.421\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2da9b29d-6370-e263-afcc-4c90e8d0d7d6\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=9cd2c66b-d3f2-3342-77a1-fde6e819ac29&entitlementId=2da9b29d-6370-e263-afcc-4c90e8d0d7d6&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"e6afc57e-e948-0700-1f5b-021330ec499e\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"9cd2c66b-d3f2-3342-77a1-fde6e819ac29\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9PCTGDFXVZLJ\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-07-07T01:54:10.2890432+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.421\t8001\t\"Adding lease {CDEB45AC-6FCC-27AB-FE4F-2AF4AC3BBBDD} to results\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (387)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.421\t8001\t\"Returning 1 lease documents for contentid 9CD2C66B-D3F2-3342-77A1-FDE6E819AC29\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.422\t8001\t\"lease = 0x8313a588, usage = 536870912, policy = 2147483647, operation = 3, leaseBehavior = 0, shouldContentBeDeactivated = 0\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (905)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.422\t8001\t\"lease = 0x8313a588, quality = 1073741824\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (935)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.422\t8001\t\"content is alreadyLicensed, lease is cached\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (942)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.422\t8011\t0x21f83176b80: 13732: 9CD2C66B-D3F2-3342-77A1-FDE6E819AC29: Dispatch: Key:@LicenseDone => Key:NegotiatingUnleased\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.424\t8001\t\"canDisableApps value is 0\nFunction: InitStoreAppsAreDisabled\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (195)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.424\t8001\t\"lease = 0x8313a588, leaseActive = 1, leaseBehavior = 0\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1986)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.424\t8001\t\"Lease Machine: 0000021F8312AC00: {2779D781-9DB3-5818-8A8F-961408D4CA65}\nFunction: LeaseMachine::LeaseMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (40)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.424\t8001\t\"Set results for lease = 0x8313a588, policy = 2147483647, operation = 3, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.424\t8011\t0x21f8312ac20: 13668: {2779D781-9DB3-5818-8A8F-961408D4CA65}: Dispatch: Lease:UpdateLeaseDocument => Lease:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.424\t8001\t\"No cached lease or key found, not renewing with service and treating this as a valid license with lease = 0x8313a588\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (2032)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.424\t8012\t0x21f83176b80: 13732: Key:NegotiatingUnleased Change: Key:Valid => 9CD2C66B-D3F2-3342-77A1-FDE6E819AC29\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.424\t8012\t0x21f8312ac20: 13668: Lease:Initial Change: Lease:Valid => {2779D781-9DB3-5818-8A8F-961408D4CA65}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.424\t8011\t0x21f83176b80: 13732: 9CD2C66B-D3F2-3342-77A1-FDE6E819AC29: Dispatch: Key:RegisterCallback => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.424\t8001\t\"Decoding: {\"\"legacyProductId\"\":\"\"998915e6-71dc-4fff-8a51-ec5d495514e9\"\"}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.424\t8001\t\"Skipping license manager: PFN SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.424\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2da9b29d-6370-e263-afcc-4c90e8d0d7d6\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=9cd2c66b-d3f2-3342-77a1-fde6e819ac29&entitlementId=2da9b29d-6370-e263-afcc-4c90e8d0d7d6&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"e6afc57e-e948-0700-1f5b-021330ec499e\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"9cd2c66b-d3f2-3342-77a1-fde6e819ac29\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9PCTGDFXVZLJ\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-07-07T01:54:10.2890432+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.424\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2da9b29d-6370-e263-afcc-4c90e8d0d7d6\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=9cd2c66b-d3f2-3342-77a1-fde6e819ac29&entitlementId=2da9b29d-6370-e263-afcc-4c90e8d0d7d6&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"e6afc57e-e948-0700-1f5b-021330ec499e\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"9cd2c66b-d3f2-3342-77a1-fde6e819ac29\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9PCTGDFXVZLJ\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-07-07T01:54:10.2890432+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.424\t8001\t\"ReactiveLicensingResult: 0x00000000 for SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy, 0ms\nFunction: LogReactiveLicensingResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\telemetry.cpp (512)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.424\t8001\t\"Updating lease timer for {2779D781-9DB3-5818-8A8F-961408D4CA65} to expire @ 2026-09-05T02:05:10Z (jitter was 35.787754 minutes)\nFunction: LeaseMachine::DoUpdateLeaseTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (276)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.424\t8001\t\"Added timer for {2779D781-9DB3-5818-8A8F-961408D4CA65}\nFunction: MemoryTimerService::CreateTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (57)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.424\t8011\t0x21f8312ac20: 13668: {2779D781-9DB3-5818-8A8F-961408D4CA65}: Dispatch: Lease:AddKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.425\t219\tPSMFlags for Desktop AppX process %1 with applicationID %2 is %3.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:23.475\t210\tCreated Desktop AppX container {245CDB95-A8C9-11F1-B7FF-289200F24A99} for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:23.475\t211\tAdded process 16192 to Desktop AppX container 245cdb95-a8c9-11f1-b7ff-289200f24a99 for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:23.478\t201\tCreated process 16192 for application SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_wyx1vj98g3asy!App in package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy. [LaunchProcess]\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:24.136\t62409\tFinished execution of command 'QuickShareLauncher.exe' (PID 16192).\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:24.136\t62408\tStarted execution of command 'PhoneExperienceHost.exe'.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:24.150\t8001\t\"Skipping license manager: PFN Microsoft.YourPhone_1.26071.164.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.151\t219\tPSMFlags for Desktop AppX process %1 with applicationID %2 is %3.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:24.161\t211\tAdded process 16216 to Desktop AppX container 245cdb4d-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.YourPhone_1.26071.164.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:24.162\t201\tCreated process 16216 for application Microsoft.YourPhone_8wekyb3d8bbwe!App in package Microsoft.YourPhone_1.26071.164.0_x64__8wekyb3d8bbwe. [LaunchProcess]\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:24.165\t505\t\"Compatibility fix applied to C:\\Program Files\\WindowsApps\\Microsoft.YourPhone_1.26071.164.0_x64__8wekyb3d8bbwe\\PhoneExperienceHost.exe.\nFix information: Microsoft Apps, {81ecdb97-5112-41af-9a59-5ba9444f4270}, 0x80010101.\"\tInformation\tMicrosoft-Windows-Application-Experience/Program-Telemetry\tMicrosoft-Windows-Application-Experience\n05.09.2026 08:29:24.506\t505\t\"Compatibility fix applied to C:\\Program Files\\WindowsApps\\Microsoft.YourPhone_1.26071.164.0_x64__8wekyb3d8bbwe\\YourPhoneAppProxyHost.exe.\nFix information: Microsoft Apps, {81ecdb97-5112-41af-9a59-5ba9444f4270}, 0x80010101.\"\tInformation\tMicrosoft-Windows-Application-Experience/Program-Telemetry\tMicrosoft-Windows-Application-Experience\n05.09.2026 08:29:24.556\t2002\t\"Setting MSA Client Id for Token requests: {f0c62012-2cef-4831-b1f7-930682874c86}\nError: Unspecified error\nFunction: \nSource: onecoreuap\\enduser\\winstore\\auth\\lib\\winstoreauth.cpp (206)\"\tInformation\tMicrosoft-Windows-Store/Operational\tWindows-ApplicationModel-Store-SDK\n05.09.2026 08:29:24.558\t2002\t\"Windows::Services::Store::StoreContextFactory::GetDefault() invoked. (CV:exbuXxFHwECWL3f3.2)\nError: Unknown HResult Error code: 0xefffffff\nFunction: Windows::Services::Store::StoreContextFactory::GetDefault\nSource: onecoreuap\\enduser\\winstore\\licensing\\winrt\\lib\\storecontext.cpp (63)\"\tInformation\tMicrosoft-Windows-Store/Operational\tWindows-ApplicationModel-Store-SDK\n05.09.2026 08:29:24.570\t8001\t\"Licensing package Microsoft.YourPhone_1.26071.164.0_x64__8wekyb3d8bbwe (3)\nFunction: OneStoreApplicationLicenseManager::GetLicenseForInstalledPackage\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\onestoreapplicensemanager.cpp (120)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.570\t8001\t\"Licensing EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED (Active)\nFunction: LicenseManager::LicenseContentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\manager.cpp (88)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.570\t8001\t\"0000021F83178E70: Key Machine for content: EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED\nFunction: KeyMachine::KeyMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (95)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.570\t8011\t0x21f83133e68: 13668: RootMachine: Dispatch: Root:Connect => Root:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.570\t8011\t0x21f83178e90: 13668: EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED: Dispatch: Key:Activate => Key:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.570\t8001\t\"0000021F83178E70: BeginLicense: Operation 3, CachedLeaseOK true, RequireServiceValidation false\nFunction: KeyMachine::DoBeginLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (819)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.570\t8012\t0x21f83178e90: 13668: Key:Initial Change: Key:NegotiatingUnleased => EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.572\t8001\t\"Considering License ID {0F8E2CD5-B8EB-7A22-B9E9-9B1183FA0A84} for content ID EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.572\t8001\t\"Decoding: {\"\"legacyProductId\"\":\"\"6ead4a77-d076-4866-9188-621a5b1f414f\"\"}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.572\t8001\t\"Accepting key with License ID {0F8E2CD5-B8EB-7A22-B9E9-9B1183FA0A84} for Content ID EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED (first match)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (223)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.572\t8001\t\"Returning key document for contentid EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (262)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.572\t8001\t\"Getting lease for EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED\nFunction: LicenseManagerCore::GetExistingLeaseAndLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (415)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.575\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"200dc622-8cbd-e337-4d4b-69d2fa6e7df7\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966575679381420&contentId=eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed&entitlementId=200dc622-8cbd-e337-4d4b-69d2fa6e7df7&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"0f8e2cd5-b8eb-7a22-b9e9-9b1183fa0a84\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NMPJ99VJBWV\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-08-04T14:54:13.8630559+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.575\t8001\t\"Adding lease {A900C622-99E6-0D09-3F2B-FC30E2F4563B} to results\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (387)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.575\t8001\t\"Returning 1 lease documents for contentid EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.576\t8001\t\"lease = 0x83178128, usage = 536870912, policy = 2147483647, operation = 3, leaseBehavior = 0, shouldContentBeDeactivated = 0\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (905)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.576\t8001\t\"lease = 0x83178128, quality = 1073741824\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (935)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.576\t8001\t\"content is alreadyLicensed, lease is cached\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (942)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.576\t8011\t0x21f83178e90: 13732: EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED: Dispatch: Key:@LicenseDone => Key:NegotiatingUnleased\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.580\t8001\t\"lease = 0x83178128, leaseActive = 1, leaseBehavior = 0\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1986)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.580\t8001\t\"Lease Machine: 0000021F8312AA00: {7BA318A1-DC47-F731-723C-537E883DC563}\nFunction: LeaseMachine::LeaseMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (40)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.580\t8001\t\"Set results for lease = 0x83178128, policy = 2147483647, operation = 3, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.580\t8011\t0x21f8312aa20: 13668: {7BA318A1-DC47-F731-723C-537E883DC563}: Dispatch: Lease:UpdateLeaseDocument => Lease:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.580\t8001\t\"No cached lease or key found, not renewing with service and treating this as a valid license with lease = 0x83178128\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (2032)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.580\t8012\t0x21f83178e90: 13732: Key:NegotiatingUnleased Change: Key:Valid => EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.580\t8012\t0x21f8312aa20: 13668: Lease:Initial Change: Lease:Valid => {7BA318A1-DC47-F731-723C-537E883DC563}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.580\t8001\t\"Decoding: {\"\"legacyProductId\"\":\"\"6ead4a77-d076-4866-9188-621a5b1f414f\"\"}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.580\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"200dc622-8cbd-e337-4d4b-69d2fa6e7df7\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966575679381420&contentId=eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed&entitlementId=200dc622-8cbd-e337-4d4b-69d2fa6e7df7&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"0f8e2cd5-b8eb-7a22-b9e9-9b1183fa0a84\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NMPJ99VJBWV\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-08-04T14:54:13.8630559+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.580\t8011\t0x21f83178e90: 13732: EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED: Dispatch: Key:RegisterCallback => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.580\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"200dc622-8cbd-e337-4d4b-69d2fa6e7df7\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966575679381420&contentId=eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed&entitlementId=200dc622-8cbd-e337-4d4b-69d2fa6e7df7&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"0f8e2cd5-b8eb-7a22-b9e9-9b1183fa0a84\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NMPJ99VJBWV\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-08-04T14:54:13.8630559+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.581\t8001\t\"Updating lease timer for {7BA318A1-DC47-F731-723C-537E883DC563} to expire @ 2026-09-05T02:04:00Z (jitter was 34.593315 minutes)\nFunction: LeaseMachine::DoUpdateLeaseTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (276)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.581\t8001\t\"Added timer for {7BA318A1-DC47-F731-723C-537E883DC563}\nFunction: MemoryTimerService::CreateTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (57)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.581\t8011\t0x21f8312aa20: 13668: {7BA318A1-DC47-F731-723C-537E883DC563}: Dispatch: Lease:AddKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.582\t2002\t\"StoreContextServer::Initialize: packageFullName = Microsoft.YourPhone_1.26071.164.0_x64__8wekyb3d8bbwe, productStoreId = 9NMPJ99VJBWV, isLicensed = true, isAppContainer = false\nError: Unknown HResult Error code: 0xefffffff\nFunction: Windows::Services::Store::Internal::StoreContextServer::_InitializeImpl\nSource: onecoreuap\\enduser\\winstore\\licensing\\winrt\\lib\\windows\\storecontextserver.cpp (1159)\"\tInformation\tMicrosoft-Windows-Store/Operational\tWindows-ApplicationModel-Store-SDK\n05.09.2026 08:29:24.583\t2002\t\"Windows::Services::Store::StoreContext::GetAppAndOptionalStorePackageUpdatesAsync invoked. (CV:exbuXxFHwECWL3f3.2.3)\nError: Unknown HResult Error code: 0xefffffff\nFunction: Windows::Services::Store::StoreContext::GetAppAndOptionalStorePackageUpdatesAsync\nSource: onecoreuap\\enduser\\winstore\\licensing\\winrt\\lib\\storecontext.cpp (1403)\"\tInformation\tMicrosoft-Windows-Store/Operational\tWindows-ApplicationModel-Store-SDK\n05.09.2026 08:29:24.586\t2002\t\"Adding calling package = Microsoft.YourPhone_8wekyb3d8bbwe for productId = 9NMPJ99VJBWV\nError: Unknown HResult Error code: 0xefffffff\nFunction: Windows::Services::Store::Internal::StoreContextServer::GetAppAndOptionalStorePackageUpdates\nSource: onecoreuap\\enduser\\winstore\\licensing\\winrt\\lib\\windows\\storecontextserver.cpp (3491)\"\tInformation\tMicrosoft-Windows-Store/Operational\tWindows-ApplicationModel-Store-SDK\n05.09.2026 08:29:24.610\t2000\t\"Process Name: C:\\Program Files\\WindowsApps\\Microsoft.YourPhone_1.26071.164.0_x64__8wekyb3d8bbwe\\PhoneExperienceHost.exe\nModule Name: C:\\Windows\\System32\\InstallService.dll\nBuild: 26100.1.amd64fre.ge_release.240331-1435, UBR: 9168\n\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.610\t2006\t\"Setting MSA Client Id for Token requests: {f0c62012-2cef-4831-b1f7-930682874c86}\nError: Unspecified error\nFunction: \nSource: onecoreuap\\enduser\\winstore\\auth\\lib\\winstoreauth.cpp (206)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.667\t8001\t\"Skipping license manager: PFN Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.718\t210\tCreated Desktop AppX container {245CDB9B-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:24.719\t211\tAdded process 15396 to Desktop AppX container 245cdb9b-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:24.778\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:24.835\t2005\t\"oneSettingsconcurrentDefaultInstalls = 3, oneSettingsconcurrentMinInstalls = 3\nError: Unknown HResult Error code: 0xefffffff\nFunction: GetConcurrentInstallsFromOneSettings\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (763)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.838\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:24.838\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:24.859\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:24.861\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:24.861\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:24.863\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:24.865\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p -s wlidsvc( #0x0/0x11272 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:29:24.867\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:24.868\t2000\t\"Process Name: C:\\WINDOWS\\System32\\svchost.exe\nModule Name: c:\\windows\\system32\\installservice.dll\nBuild: 26100.1.amd64fre.ge_release.240331-1435, UBR: 9168\n\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.869\t2006\t\"Setting MSA Client Id for Token requests: {f0c62012-2cef-4831-b1f7-930682874c86}\nError: Unspecified error\nFunction: \nSource: onecoreuap\\enduser\\winstore\\auth\\lib\\winstoreauth.cpp (206)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.869\t2005\t\"Initializing InstallService for shared\nError: Unknown HResult Error code: 0xefffffff\nFunction: ServiceMain\nSource: onecoreuap\\enduser\\winstore\\installservice\\svc\\svcmain.cpp (207)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.874\t2005\t\"Initializing InstallService\nError: Unknown HResult Error code: 0xefffffff\nFunction: InstallService::ServiceStarted\nSource: onecoreuap\\enduser\\winstore\\installservice\\svc\\svcmain.cpp (52)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.875\t2006\t\"[Telemetry]: StateTransition :: ProductId = (null) \u00a0PFN = (null) \u00a0CatalogId = (null) \u00a0FulfillmentPluginId = (null) \u00a0PluginTelemetryData = (null) \u00a0PrevState = ServiceStateChange \u00a0NewState = ServiceStateChange \u00a0PluginLastStage = 1 \u00a0HResult = 0 \u00a0__TlgCV__ = (null) \u00a0\nError: Unknown HResult Error code: 0xefffffff\nFunction: LogTelemetryEvent\nSource: onecoreuap\\enduser\\winstore\\installservice\\svc\\logging.cpp (10)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.877\t2006\t\"Checking if User sessions are ready\nError: The operation completed successfully.\nFunction: InstallQueue2::_WaitForUserSessions\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (5426)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.881\t2006\t\"Loaded listener for progress events. Listener = CuratedTileCollections.StoreEventListener \u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::_LoadRegistryHandlers\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (5542)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.881\t2416\tA local notification was received from Microsoft.YourPhone_8wekyb3d8bbwe!App [AppUserModelId] with a 0 [NotificationId] through an application endpoint.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:24.881\t2416\tA local notification was received from Microsoft.YourPhone_8wekyb3d8bbwe!App [AppUserModelId] with a 0 [NotificationId] through an application endpoint.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:24.882\t2006\t\"Loaded listener for progress events. Listener = EnterpriseModernAppManagement.EAMProgressHandler \u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::_LoadRegistryHandlers\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (5542)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.884\t2418\tA local notification was submitted to threadpool: Microsoft.YourPhone_8wekyb3d8bbwe!App [AppUserModelId] badge [NotificationType] 9394 [NotificationTrackingId] Local [NotificationSource].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:24.884\t2418\tA local notification was submitted to threadpool: Microsoft.YourPhone_8wekyb3d8bbwe!App [AppUserModelId] badge [NotificationType] 9395 [NotificationTrackingId] Local [NotificationSource].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:24.889\t3053\tbadge with notification tracking id 9394 is being delivered to Microsoft.YourPhone_8wekyb3d8bbwe!App.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:24.889\t3053\tbadge with notification tracking id 9395 is being delivered to Microsoft.YourPhone_8wekyb3d8bbwe!App.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:24.893\t2006\t\"LoadCheckpointWorker CheckpointDataBlob is  QueueItemId = {\"\"InstallType\"\":\"\"Update\"\",\"\"AutomaticallyDownloadAndInstallUpdateIfFound\"\":false,\"\"AllowCachedResult\"\":false,\"\"FulfillmentData\"\":[],\"\"systemAttemptCount\"\":3} \u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::_LoadCheckpointsWorker\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (5194)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.910\t1002\tError 0x80070002 occurred while verifying known folder {1777f761-68ad-4d8a-87bd-30b759fa33dd} with path 'C:\\WINDOWS\\system32\\config\\systemprofile\\Favorites'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:29:24.913\t1002\tError 0x80070002 occurred while verifying known folder {b4bfcc3a-db2c-424c-b029-7fe99a87c641} with path 'C:\\WINDOWS\\system32\\config\\systemprofile\\Desktop'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:29:24.970\t2005\t\"OneSettingsOnlineScanInterval (in seconds) = 86400\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1220)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2005\t\"OneSettingsOnlineScansAllowedInInterval = 10\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1222)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2005\t\"OneSettingsOnlineScanCooldown (in seconds) = 30\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1243)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (537)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (537)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (556)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (556)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (537)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2005\t\"DirectDownloadEnablementState fetched from cache: 2\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadDirectDownloadEnablementState\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2867)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2005\t\"DirectDownloadEnablementSettings fetched from OneSettings payload: [{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[\"\"Install\"\"],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[\"\"Microsoft.WindowsStore_8wekyb3d8bbwe\"\"],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[\"\"9NKSQGP7F2NH\"\",\"\"9NRX63209R7B\"\",\"\"9NTXR16HNW1T\"\",\"\"9PLM9XGG6VKS\"\"],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[\"\"0x00000000\"\",\"\"0x80004004\"\",\"\"0x80070032\"\",\"\"0x8007029C\"\",\"\"0x8007045B\"\",\"\"0x80070520\"\",\"\"0x80073CFB\"\",\"\"0x80073CFF\"\",\"\"0x80073D0A\"\",\"\"0x80073D13\"\",\"\"0x80073D19\"\",\"\"0x80073D22\"\",\"\"0x80240008\"\",\"\"0x8024001E\"\",\"\"0x80240066\"\",\"\"0x803FB003\"\",\"\"0x803FB015\"\",\"\"0xC8000710\"\",\"\"0x80073CF4\"\",\"\"0x80073D01\"\",\"\"0x80070070\"\",\"\"0x80073D21\"\",\"\"0x80246017\"\",\"\"0x80073CFE\"\"],\"\"regions\"\":[],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[\"\"9PLRGHGXR4FM\"\"],\"\"arches\"\":[],\"\"installTypes\"\":[\"\"Install\"\"],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Allowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[\"\"CN\"\"],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[\"\"9N3RK8ZV2ZR8\"\",\"\"9NRZT3Q9R3DL\"\",\"\"9P2B8MCSVPLN\"\",\"\"9NPV76S164X5\"\",\"\"9NBLGGH4RV3P\"\",\"\"9NBLGGH4SVJT\"\",\"\"9PHBC65ZG12V\"\",\"\"9NKSQGP7F2NH\"\",\"\"9NKRJ3SJ9SDG\"\"],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[\"\"DellInc.AlienwareCommandCenter_htrsf667h5kn2\"\",\"\"DSIC\"\",\"\"explorer\"\",\"\"AICompanion\"\",\"\"HP.Omen.OmenCommandCenter\"\",\"\"setup\"\",\"\"Language Overlay Service\"\",\"\"TabTip\"\",\"\"LiveCaptions\"\",\"\"Undetermined\"\",\"\"GamingService\"\"],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[\"\"Install\"\"],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Allowed\"\"}]\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadDirectDownloadEnablementSettings\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2891)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2944)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2007\t\"Error while reading DirectDownloadReplacementSettings from OneSettings cache, value will remain empty\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1360)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2005\t\"DirectDownloadEnablementLiveCheckThreshold in milliseconds fetched from cache: 600000\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadDirectDownloadEnablementLiveCheckThreshold\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (3005)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2005\t\"ProductCatalogUrl fetched from cache: https://fe3cr.delivery.mp.microsoft.com/ClientWebService/client.asmx/secured\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadProductCatalogUrl\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (3027)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2005\t\"SfEdgeFallbackEndpointUrl fetched from cache: https://sfdataservice.microsoft.com/package-retrieval\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadSfEdgeFallbackEndpointUrl\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (3048)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2005\t\"CheckpointAbandonmentRules fetched from OneSettings payload: [{\"\"callerApplicationIdKeyword\"\":\"\"WindowsStore\"\",\"\"systemAttemptCountThreshold\"\":5,\"\"creationTimestampThresholdInDays\"\":2},{\"\"callerApplicationIdKeyword\"\":\"\"MoUsoCoreWorker\"\",\"\"systemAttemptCountThreshold\"\":2,\"\"creationTimestampThresholdInDays\"\":2}]\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadCheckpointAbandonmentRules\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (3235)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (556)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (575)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2006\t\"Update block list not found or empty in OneSettings\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1457)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.971\t2006\t\"CreateInstallServiceWorkFromBridge. SystemAttemptCount is 3\nError: Unknown HResult Error code: 0xefffffff\nFunction: CreateInstallServiceWorkFromBridge\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\uwainstallworkbridge.cpp (1791)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.971\t2006\t\"[Start] Creating UWA Work\u00a0FulfillmentData = {\"\"ProductId\"\":\"\"9NZKPSTSNW4P\"\",\"\"WuBundleId\"\":\"\"97749f59-fa5c-47b6-aba6-d370e97f3f9e\"\",\"\"WuCategoryId\"\":\"\"9607e6e2-46a5-4a17-afca-908ffc36d70b\"\",\"\"PackageFamilyName\"\":\"\"Microsoft.XboxGamingOverlay_8wekyb3d8bbwe\"\",\"\"SkuId\"\":\"\"0010\"\",\"\"Content\"\":null,\"\"PackageFeatures\"\":null} \u00a0\nError: The operation completed successfully.\nFunction: UWAInstallServiceWorkItem::UWAInstallServiceWorkItem\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\uwainstallworkbridge.cpp (494)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.971\t2007\t\"InstallService InProc Caller. Current Thread not impersonating. Using current process (LocalSystem)\nError: Unknown HResult Error code: 0xefffffff\nFunction: CallerContext::_getCallerToken\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\callercontext.cpp (92)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.975\t2416\tA local notification was received from Microsoft.YourPhone_8wekyb3d8bbwe!App [AppUserModelId] with a 0 [NotificationId] through an application endpoint.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:24.976\t2418\tA local notification was submitted to threadpool: Microsoft.YourPhone_8wekyb3d8bbwe!App [AppUserModelId] badge [NotificationType] 9396 [NotificationTrackingId] Local [NotificationSource].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:24.980\t3053\tbadge with notification tracking id 9396 is being delivered to Microsoft.YourPhone_8wekyb3d8bbwe!App.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:25.000\t2006\t\"AppId = 9607e6e2-46a5-4a17-afca-908ffc36d70b, WU Installed Flag = 0, OnlineSearch = 0, Interactive = 0, Scope = 2, Client ID = Update;Microsoft.XboxGamingOverlay_8wekyb3d8bbwe-SearchForUpdatesWithPausedAddAsync\nError: Unknown HResult Error code: 0xefffffff\nFunction: SearchUpdatePackages\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\wuhelpers.cpp (280)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.003\t2006\t\"UUS Version = 1509.2607.1012.0\nError: Unknown HResult Error code: 0xefffffff\nFunction: SearchUpdatePackages\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\wuhelpers.cpp (286)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.003\t2006\t\"WU query: \"\"IsInstalled=0 AND AppCategoryIDs contains '9607e6e2-46a5-4a17-afca-908ffc36d70b'\"\"\nError: Unknown HResult Error code: 0xefffffff\nFunction: SearchUpdatePackages\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\wuhelpers.cpp (359)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.038\t2005\t\"oneSettingsconcurrentDefaultInstalls = 3, oneSettingsconcurrentMinInstalls = 3\nError: Unknown HResult Error code: 0xefffffff\nFunction: GetConcurrentInstallsFromOneSettings\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (763)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.039\t2006\t\"[Telemetry]: Stats :: AppControlPreferenceOptions = 99 \u00a0ShouldHonorAppUpdatePauseFlags = 0 \u00a0\nError: Unknown HResult Error code: 0xefffffff\nFunction: LogTelemetryEvent\nSource: onecoreuap\\enduser\\winstore\\installservice\\svc\\logging.cpp (10)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.040\t2006\t\"[Telemetry]: Stats :: AppControlPreferenceOptions = 99 \u00a0ShouldHonorAppUpdatePauseFlags = 0 \u00a0\nError: Unknown HResult Error code: 0xefffffff\nFunction: LogTelemetryEvent\nSource: onecoreuap\\enduser\\winstore\\installservice\\svc\\logging.cpp (10)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.041\t2006\t\"[Telemetry]: StateTransition :: ProductId = (null) \u00a0PFN = (null) \u00a0CatalogId = (null) \u00a0FulfillmentPluginId = (null) \u00a0PluginTelemetryData = (null) \u00a0PrevState = ServiceStateChange \u00a0NewState = ServiceStateChange \u00a0PluginLastStage = 4 \u00a0HResult = 0 \u00a0__TlgCV__ = (null) \u00a0\nError: Unknown HResult Error code: 0xefffffff\nFunction: LogTelemetryEvent\nSource: onecoreuap\\enduser\\winstore\\installservice\\svc\\logging.cpp (10)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.706\t2006\t\"WU scan found 0 packages\nError: Unknown HResult Error code: 0xefffffff\nFunction: _PackagesFromSearchResult\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\wuhelpers.cpp (157)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.706\t2007\t\"Failure detected\nError: Unknown HResult Error code: 0x80240024\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\uwainstallworkbridge.cpp (569)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.706\t2008\t\"[Error] Creating UWA Work\u00a0FulfillmentData = {\"\"ProductId\"\":\"\"9NZKPSTSNW4P\"\",\"\"WuBundleId\"\":\"\"97749f59-fa5c-47b6-aba6-d370e97f3f9e\"\",\"\"WuCategoryId\"\":\"\"9607e6e2-46a5-4a17-afca-908ffc36d70b\"\",\"\"PackageFamilyName\"\":\"\"Microsoft.XboxGamingOverlay_8wekyb3d8bbwe\"\",\"\"SkuId\"\":\"\"0010\"\",\"\"Content\"\":null,\"\"PackageFeatures\"\":null} \u00a0\nError: The operation completed successfully.\nFunction: UWAInstallServiceWorkItem::UWAInstallServiceWorkItem\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\uwainstallworkbridge.cpp (494)\"\tError\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.706\t2008\t\"Error creating work item\u00a0\nError: Unknown HResult Error code: 0x80240024\nFunction: UWAInstallServiceWorkItem::UWAInstallServiceWorkItem\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\uwainstallworkbridge.cpp (652)\"\tError\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.706\t2006\t\"Failure detected\nError: Unknown HResult Error code: 0x80240024\nFunction: \nSource: NULL (0)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.706\t2006\t\"winrt::hresult_error: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\uwainstallworkbridge.cpp(569)\\installservice.dll!00007FFBBFA131E5: (caller: 00007FFBBFA1056E) Exception(1) tid(1bb0) 80240024\nError: Unknown HResult Error code: 0x80240024\nFunction: \nSource: NULL (0)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.706\t2006\t\"Failure detected\nError: Unknown HResult Error code: 0x80240024\nFunction: \nSource: NULL (0)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.706\t2007\t\"Failed to recover work from checkpoint. PackageFamilyName = Microsoft.XboxGamingOverlay_8wekyb3d8bbwe, cv = MF/KZgpOVUygJPUL.4.3.1.2.0, HRESULT = 0x80240024\u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::_LoadCheckpointsWorker\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (5352)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.706\t2006\t\"LoadCheckpointWorker CheckpointDataBlob is  QueueItemId = {\"\"InstallType\"\":\"\"Install\"\",\"\"FulfillmentData\"\":[],\"\"systemAttemptCount\"\":26} \u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::_LoadCheckpointsWorker\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (5194)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.707\t2006\t\"CreateInstallServiceWorkFromBridge. SystemAttemptCount is 26\nError: Unknown HResult Error code: 0xefffffff\nFunction: CreateInstallServiceWorkFromBridge\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\uwainstallworkbridge.cpp (1791)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.707\t2006\t\"[Start] Creating UWA Work\u00a0FulfillmentData = {\"\"ProductId\"\":\"\"9NRZT3Q9R3DL\"\",\"\"WuBundleId\"\":\"\"1c9d0171-5785-4dca-a220-41429db28c92\"\",\"\"WuCategoryId\"\":\"\"23f6ac41-7701-46ef-81fe-d3bc61d011bf\"\",\"\"PackageFamilyName\"\":\"\"Microsoft.WindowsAppRuntime.2_8wekyb3d8bbwe\"\",\"\"SkuId\"\":\"\"0010\"\",\"\"Content\"\":null,\"\"PackageFeatures\"\":null,\"\"PackageRankId\"\":\"\"100\"\",\"\"PackageFullNameId\"\":\"\"Microsoft.WindowsAppRuntime.2_2.3.1.0_x64__8wekyb3d8bbwe\"\",\"\"ParentBundleId\"\":\"\"\"\"} \u00a0\nError: The operation completed successfully.\nFunction: UWAInstallServiceWorkItem::UWAInstallServiceWorkItem\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\uwainstallworkbridge.cpp (312)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.707\t2007\t\"InstallService InProc Caller. Current Thread not impersonating. Using current process (LocalSystem)\nError: Unknown HResult Error code: 0xefffffff\nFunction: CallerContext::_getCallerToken\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\callercontext.cpp (92)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.708\t2005\t\"Processing fulfillment data: PackageRank=100, PackageFullName=Microsoft.WindowsAppRuntime.2_2.3.1.0_x64__8wekyb3d8bbwe\nError: Unknown HResult Error code: 0xefffffff\nFunction: UWAInstallWork::UWAInstallWork\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\uwainstallwork.cpp (613)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.708\t2006\t\"[End] Creating UWA Work\u00a0FulfillmentData = {\"\"ProductId\"\":\"\"9NRZT3Q9R3DL\"\",\"\"WuBundleId\"\":\"\"1c9d0171-5785-4dca-a220-41429db28c92\"\",\"\"WuCategoryId\"\":\"\"23f6ac41-7701-46ef-81fe-d3bc61d011bf\"\",\"\"PackageFamilyName\"\":\"\"Microsoft.WindowsAppRuntime.2_8wekyb3d8bbwe\"\",\"\"SkuId\"\":\"\"0010\"\",\"\"Content\"\":null,\"\"PackageFeatures\"\":null,\"\"PackageRankId\"\":\"\"100\"\",\"\"PackageFullNameId\"\":\"\"Microsoft.WindowsAppRuntime.2_2.3.1.0_x64__8wekyb3d8bbwe\"\",\"\"ParentBundleId\"\":\"\"\"\"} \u00a0\nError: The operation completed successfully.\nFunction: UWAInstallServiceWorkItem::UWAInstallServiceWorkItem\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\uwainstallworkbridge.cpp (312)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.762\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.762\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.763\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.763\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.763\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.764\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.764\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.764\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.765\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.765\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.765\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.766\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.766\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.766\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.766\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.768\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tRead Credential\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.773\t2006\t\"Catalog Cache items read from disk into memory. Loaded item count:  = 68 \u00a0Deleted item count:  = 3 \u00a0\nError: The operation completed successfully.\nFunction: CatalogDataStore::_ReadCacheFromDisk\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\catalogdatastore.cpp (473)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.773\t2006\t\"[Start] Creating Queue Item for the workCatalogId = PackageFamilyName:Microsoft.WindowsAppRuntime.2_8wekyb3d8bbwe \u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::_EnqueueWork\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (2244)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.774\t2006\t\"[End] Creating Queue Item for the workCatalogId = PackageFamilyName:Microsoft.WindowsAppRuntime.2_8wekyb3d8bbwe \u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::_EnqueueWork\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (2244)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.774\t2006\t\"[Start] Item inserted into the queue. Attempting to create progresstrackersItem = 9NRZT3Q9R3DL \u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::_EnqueueWork\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (2335)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.774\t2006\t\"[End] Item inserted into the queue. Attempting to create progresstrackersItem = 9NRZT3Q9R3DL \u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::_EnqueueWork\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (2335)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.775\t2006\t\"Received checkpoint data updateItem = 9NRZT3Q9R3DL \u00a0\u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::NotifyCheckpointChanged\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (3602)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.775\t2006\t\"Unable to delete StorePreSearchTimes registry key\nError: The system cannot find the file specified.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (5579)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.775\t2006\t\"Raising State Change for Item = , InstallState = 12 \u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::FlushEventQueue\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (3547)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.776\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.776\t2152\tInstall progress state changed for package:Microsoft.WindowsAppRuntime.2_8wekyb3d8bbwe to state:12.\tInformation\tMicrosoft-Windows-ShellCommon-StartLayoutPopulation/Operational\tMicrosoft-Windows-ShellCommon-StartLayoutPopulation\n05.09.2026 08:29:25.776\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.777\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.777\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.777\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.778\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.778\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.778\t2006\t\"Queue State: Working = 0, Pending = 0, Idle = 1 \u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::_FindNextPendingItem\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (4794)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.778\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.779\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.779\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.779\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.779\t2007\t\"No CV passed in - generating a new one.\nError: The operation completed successfully.\nFunction: WindowsUpdate::CommonTelemetry::GenerateIfMissingCorrelationVector\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\commontelemetry.cpp (375)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.779\t2006\t\"request: ProductId = (vector), checkApplicability = false, CV = fZ45hDIq50OyI64m.0\nError: Unknown HResult Error code: 0xefffffff\nFunction: Windows::ApplicationModel::Store::Preview::InstallControl::AppInstallManagerImpl::GetAppDataForUserAsync\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\appinstallcontrol.cpp (3802)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.779\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.780\t2006\t\"request: addAsPaused = true, clientID = PhoneExperienceHost, CV = exbuXxFHwECWL3f3.2.3.1.2\nError: Unknown HResult Error code: 0xefffffff\nFunction: Windows::ApplicationModel::Store::Preview::InstallControl::AppInstallManagerImpl::SearchForUpdatesWithPausedAddAsync\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\appinstallcontrol.cpp (4726)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.780\t2006\t\"Checking interactive for update for scan caller: PhoneExperienceHost-SearchForUpdatesWithPausedAddAsync\nError: Unknown HResult Error code: 0xefffffff\nFunction: Utils::IsCallerInteractive\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\utils.cpp (385)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.780\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.783\t2006\t\"Failure detected\nError: The system cannot find the file specified.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\auth\\lib\\winstoreauth.cpp (2614)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.784\t2006\t\"Failure detected\nError: A specified logon session does not exist. It may already have been terminated.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\auth\\lib\\winstoreauth.cpp (1792)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.784\t2006\t\"Failure detected\nError: A specified logon session does not exist. It may already have been terminated.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\auth\\lib\\winstoreauth.cpp (1882)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.784\t2006\t\"Failure detected\nError: A specified logon session does not exist. It may already have been terminated.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\auth\\lib\\winstoreauth.cpp (2576)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.784\t2006\t\"Failure detected\nError: A specified logon session does not exist. It may already have been terminated.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\auth\\lib\\winstoreauth.cpp (334)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.784\t2007\t\"No tickets found for the store primary acount.\nError: A specified logon session does not exist. It may already have been terminated.\nFunction: TryGetTickets\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\storeappinfo.cpp (1223)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.787\t2006\t\"Failure detected\nError: A specified logon session does not exist. It may already have been terminated.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\auth\\lib\\winstoreauth.cpp (1862)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.787\t2006\t\"Failure detected\nError: A specified logon session does not exist. It may already have been terminated.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\auth\\lib\\winstoreauth.cpp (564)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.787\t2006\t\"Failure detected\nError: A specified logon session does not exist. It may already have been terminated.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\auth\\lib\\winstoreauth.cpp (751)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.787\t2006\t\"Failure detected\nError: A specified logon session does not exist. It may already have been terminated.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\auth\\lib\\winstoreauth.cpp (477)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.787\t2006\t\"Failure detected\nError: A specified logon session does not exist. It may already have been terminated.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\auth\\lib\\winstoreauthstatics.cpp (134)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.787\t2007\t\"No tickets found for the current user.\nError: A specified logon session does not exist. It may already have been terminated.\nFunction: TryGetTickets\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\storeappinfo.cpp (1294)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.789\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.789\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.789\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.790\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.790\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.790\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.791\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.791\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.791\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.792\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.792\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.792\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.792\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.792\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.793\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.793\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.795\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.796\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.817\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.818\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.818\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.819\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.819\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.819\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.820\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.820\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.820\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.820\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.821\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.821\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.821\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.822\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.866\t2005\t\"OneSettingsOnlineScanInterval (in seconds) = 86400\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1220)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2005\t\"OneSettingsOnlineScansAllowedInInterval = 10\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1222)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2005\t\"OneSettingsOnlineScanCooldown (in seconds) = 30\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1243)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (537)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (537)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (556)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (556)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (537)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2005\t\"DirectDownloadEnablementState fetched from cache: 2\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadDirectDownloadEnablementState\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2867)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2005\t\"DirectDownloadEnablementSettings fetched from OneSettings payload: [{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[\"\"Install\"\"],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[\"\"Microsoft.WindowsStore_8wekyb3d8bbwe\"\"],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[\"\"9NKSQGP7F2NH\"\",\"\"9NRX63209R7B\"\",\"\"9NTXR16HNW1T\"\",\"\"9PLM9XGG6VKS\"\"],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[\"\"0x00000000\"\",\"\"0x80004004\"\",\"\"0x80070032\"\",\"\"0x8007029C\"\",\"\"0x8007045B\"\",\"\"0x80070520\"\",\"\"0x80073CFB\"\",\"\"0x80073CFF\"\",\"\"0x80073D0A\"\",\"\"0x80073D13\"\",\"\"0x80073D19\"\",\"\"0x80073D22\"\",\"\"0x80240008\"\",\"\"0x8024001E\"\",\"\"0x80240066\"\",\"\"0x803FB003\"\",\"\"0x803FB015\"\",\"\"0xC8000710\"\",\"\"0x80073CF4\"\",\"\"0x80073D01\"\",\"\"0x80070070\"\",\"\"0x80073D21\"\",\"\"0x80246017\"\",\"\"0x80073CFE\"\"],\"\"regions\"\":[],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[\"\"9PLRGHGXR4FM\"\"],\"\"arches\"\":[],\"\"installTypes\"\":[\"\"Install\"\"],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Allowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[\"\"CN\"\"],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[\"\"9N3RK8ZV2ZR8\"\",\"\"9NRZT3Q9R3DL\"\",\"\"9P2B8MCSVPLN\"\",\"\"9NPV76S164X5\"\",\"\"9NBLGGH4RV3P\"\",\"\"9NBLGGH4SVJT\"\",\"\"9PHBC65ZG12V\"\",\"\"9NKSQGP7F2NH\"\",\"\"9NKRJ3SJ9SDG\"\"],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[\"\"DellInc.AlienwareCommandCenter_htrsf667h5kn2\"\",\"\"DSIC\"\",\"\"explorer\"\",\"\"AICompanion\"\",\"\"HP.Omen.OmenCommandCenter\"\",\"\"setup\"\",\"\"Language Overlay Service\"\",\"\"TabTip\"\",\"\"LiveCaptions\"\",\"\"Undetermined\"\",\"\"GamingService\"\"],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[\"\"Install\"\"],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Allowed\"\"}]\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadDirectDownloadEnablementSettings\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2891)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2944)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2007\t\"Error while reading DirectDownloadReplacementSettings from OneSettings cache, value will remain empty\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1360)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2005\t\"DirectDownloadEnablementLiveCheckThreshold in milliseconds fetched from cache: 600000\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadDirectDownloadEnablementLiveCheckThreshold\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (3005)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2005\t\"ProductCatalogUrl fetched from cache: https://fe3cr.delivery.mp.microsoft.com/ClientWebService/client.asmx/secured\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadProductCatalogUrl\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (3027)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2005\t\"SfEdgeFallbackEndpointUrl fetched from cache: https://sfdataservice.microsoft.com/package-retrieval\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadSfEdgeFallbackEndpointUrl\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (3048)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2005\t\"CheckpointAbandonmentRules fetched from OneSettings payload: [{\"\"callerApplicationIdKeyword\"\":\"\"WindowsStore\"\",\"\"systemAttemptCountThreshold\"\":5,\"\"creationTimestampThresholdInDays\"\":2},{\"\"callerApplicationIdKeyword\"\":\"\"MoUsoCoreWorker\"\",\"\"systemAttemptCountThreshold\"\":2,\"\"creationTimestampThresholdInDays\"\":2}]\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadCheckpointAbandonmentRules\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (3235)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (556)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (575)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2006\t\"Update block list not found or empty in OneSettings\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1457)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2006\t\"Checking if top-level window is visible for PhoneExperienceHost-SearchForUpdatesWithPausedAddAsync, setting userInteractive = false\nError: Unknown HResult Error code: 0xefffffff\nFunction: Utils::IsCallerInteractive\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\utils.cpp (427)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.869\t2006\t\"Scan allowed inside interval for Microsoft.YourPhone_8wekyb3d8bbwe. Current last scan time cache: 2026-09-04T11:58:29+07:00;2026-09-04T12:02:46+07:00;2026-09-04T16:47:41+07:00;2026-09-05T08:29:25+07:00\nError: Unknown HResult Error code: 0xefffffff\nFunction: OnlineScanAllowedInInterval\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\stringhelpers.cpp (479)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.869\t2006\t\"Last scan time calculated, setting online = 1\nError: Unknown HResult Error code: 0xefffffff\nFunction: GetIsOnlineScanAllowed\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\uwainstallworkbridge.cpp (2374)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.870\t2006\t\"[Telemetry]: BeginScanForUpdates :: _TlgCV_ = exbuXxFHwECWL3f3.2.3.1.2.0.1 \u00a0IsOnline = true \u00a0IsApplicability = false \u00a0ClientAppId = Update;PhoneExperienceHost-SearchForUpdatesWithPausedAddAsync \u00a0IsInteractive = false \u00a0\nError: Unknown HResult Error code: 0xefffffff\nFunction: LogTelemetryEvent\nSource: onecoreuap\\enduser\\winstore\\installservice\\svc\\logging.cpp (10)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:26.506\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:26.507\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:26.510\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:26.510\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:26.510\t2006\t\"Cannot get any user tickets. Using device ticket\nError: The operation completed successfully.\nFunction: TryGetTickets\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\storeappinfo.cpp (1319)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:27.019\t2006\t\"[Telemetry]: DownloadUrl :: __TlgCV__ = fZ45hDIq50OyI64m.0.1.3 \u00a0PartB_Ms.Qos.OutgoingServiceRequest = 14 \u00a0operationName = DownloadUrl \u00a0targetUri = https://displaycatalog.mp.microsoft.com/v7.0/products/9NRZT3Q9R3DL/?fieldsTemplate=InstallAgent&market=RU&languages=en-US,en,neutral \u00a0latencyMs = 516 \u00a0serviceErrorCode = 0 \u00a0succeeded = true \u00a0requestMethod = GET \u00a0responseContentType = JSON \u00a0protocol = HTTP \u00a0protocolStatusCode = 200 \u00a0dependencyOperationName =  \u00a0dependencyOperationVersion =  \u00a0dependencyName =  \u00a0dependencyType =  \u00a0responseSizeBytes = 44249 \u00a0HResult = 0 \u00a0\nError: Unknown HResult Error code: 0xefffffff\nFunction: LogTelemetryEvent\nSource: onecoreuap\\enduser\\winstore\\installservice\\svc\\logging.cpp (10)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:27.019\t2006\t\"Http GET response: https://displaycatalog.mp.microsoft.com/v7.0/products/9NRZT3Q9R3DL/?fieldsTemplate=InstallAgent&market=RU&languages=en-US,en,neutral\nError: The operation completed successfully.\nFunction: FetchUriResponseWithAuthTicket\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\httphelpers.cpp (369)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:27.021\t2005\t\"Device Info: DeviceFamily = Windows.Desktop, Version = 2814751484158928, Arch = AMD64 (K8)\u00a0\nError: The operation completed successfully.\nFunction: FindFulfillmentInfo\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\productdocument2helper.cpp (380)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:27.025\t1\tError 0x80070520 occurred. See event details for more information.\tError\tMicrosoft-Windows-CloudStore/Operational\tMicrosoft-Windows-CloudStore\n05.09.2026 08:29:27.025\t2\tError 0x80070520 occurred. See event details for more information.\tError\tMicrosoft-Windows-CloudStore/Operational\tMicrosoft-Windows-CloudStore\n05.09.2026 08:29:27.026\t1\tError 0x80070520 occurred. See event details for more information.\tError\tMicrosoft-Windows-CloudStore/Operational\tMicrosoft-Windows-CloudStore\n05.09.2026 08:29:27.026\t2\tError 0x80070520 occurred. See event details for more information.\tError\tMicrosoft-Windows-CloudStore/Operational\tMicrosoft-Windows-CloudStore\n05.09.2026 08:29:27.109\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:27.109\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:27.109\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:27.109\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:27.251\t62409\tFinished execution of command 'PhoneExperienceHost.exe' (PID 16216).\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:27.310\t9705\tStarted enumeration of commands for registry key 'Software\\Microsoft\\Windows\\CurrentVersion\\Run'.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:27.310\t9707\tStarted execution of command 'IntelGraphicsSoftware.exe\" -s'.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:27.647\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:27.647\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:27.725\t2\t{\"category\":\"AppCore\",\"level\":\"Information\",\"message\":\"**** Starting ****\",\"parameters\":{\"id\":16176}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:27.844\t2\t{\"category\":\"DcaTelemetry\",\"level\":\"Information\",\"message\":\"App_Process\",\"parameters\":{\"collectionEnabled\":false,\"status\":\"Started\",\"value\":\"\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:27.868\t7040\tThe start type of the \u0424\u043e\u043d\u043e\u0432\u0430\u044f \u0438\u043d\u0442\u0435\u043b\u043b\u0435\u043a\u0442\u0443\u0430\u043b\u044c\u043d\u0430\u044f \u0441\u043b\u0443\u0436\u0431\u0430 \u043f\u0435\u0440\u0435\u0434\u0430\u0447\u0438 (BITS) service was changed from \u0412\u0440\u0443\u0447\u043d\u0443\u044e to \u0410\u0432\u0442\u043e\u043c\u0430\u0442\u0438\u0447\u0435\u0441\u043a\u0438.\tInformation\tSystem\tService Control Manager\n05.09.2026 08:29:27.887\t306\tThe BITS service loaded the job list from disk.\tVerbose\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 08:29:27.892\t145\tWSMan operation Enumeration started with resourceUri http://schemas.microsoft.com/wbem/wsman/1/config/listener\tInformation\tMicrosoft-Windows-WinRM/Operational\tMicrosoft-Windows-WinRM\n05.09.2026 08:29:28.524\t2\t{\"category\":\"AppCore\",\"level\":\"Information\",\"message\":\"Launched\",\"parameters\":{\"id\":16176}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:28.529\t2\t{\"category\":\"AppCore\",\"level\":\"Information\",\"message\":\"Instance\",\"parameters\":{\"caller\":\"OnLaunched\",\"id\":16176,\"isCurrent\":true,\"isSilent\":true}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.073\t2006\t\"WU scan found 0 packages\nError: Unknown HResult Error code: 0xefffffff\nFunction: _PackagesFromSearchResult\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\wuhelpers.cpp (157)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:29.073\t2006\t\"[Telemetry]: EndScanForUpdates :: _TlgCV_ = exbuXxFHwECWL3f3.2.3.1.2.0.1 \u00a0IsOnline = true \u00a0IsApplicability = false \u00a0IsInteractive = false \u00a0ClientAppId = Update;PhoneExperienceHost-SearchForUpdatesWithPausedAddAsync \u00a0NumberOfApplicableUpdates = 0 \u00a0AutoUpdateWorkScheduledWithUOTime =  \u00a0PFN = (null) \u00a0HResult = 0 \u00a0\nError: Unknown HResult Error code: 0xefffffff\nFunction: LogTelemetryEvent\nSource: onecoreuap\\enduser\\winstore\\installservice\\svc\\logging.cpp (10)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:29.073\t2006\t\"No updates found. CategoryIds Count = 1 \u00a0\nError: The operation completed successfully.\nFunction: ScanForMultipleUpdates\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\uwainstallworkbridge.cpp (2138)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:29.076\t2002\t\"Windows::Services::Store::StoreContext::get_CanSilentlyDownloadStorePackageUpdates() invoked. (CV:exbuXxFHwECWL3f3.2.5)\nError: Unknown HResult Error code: 0xefffffff\nFunction: Windows::Services::Store::StoreContext::get_CanSilentlyDownloadStorePackageUpdates\nSource: onecoreuap\\enduser\\winstore\\licensing\\winrt\\lib\\storecontext.cpp (1732)\"\tInformation\tMicrosoft-Windows-Store/Operational\tWindows-ApplicationModel-Store-SDK\n05.09.2026 08:29:29.104\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"IGCL Adapter initialized\",\"parameters\":{\"pciVendorID\":32902,\"pciDeviceID\":32085,\"pciRevisionID\":8,\"pciSubSysID\":8453,\"pciSubSysVendorID\":7911,\"numEUsPerSubSlice\":16,\"numSubSlicesPerSlice\":3,\"numSlices\":2,\"frequency\":2200,\"xeCores\":7,\"driverVersion\":\"32.0.101.8974\",\"firmwareVersion\":\"22.0.1067.0\",\"deviceName\":\"Intel(R) Arc(TM) Graphics\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.108\t2\t{\"category\":\"CtlLibGraphicsController\",\"level\":\"Information\",\"message\":\"Graphics adapter: Intel(R) Arc(TM) Graphics\"}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.112\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"IGCL Adapter initialized\",\"parameters\":{\"pciVendorID\":32902,\"pciDeviceID\":32085,\"pciRevisionID\":8,\"pciSubSysID\":8453,\"pciSubSysVendorID\":7911,\"numEUsPerSubSlice\":16,\"numSubSlicesPerSlice\":3,\"numSlices\":2,\"frequency\":2200,\"xeCores\":7,\"driverVersion\":\"32.0.101.8974\",\"firmwareVersion\":\"22.0.1067.0\",\"deviceName\":\"Intel(R) Arc(TM) Graphics\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.112\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"IGCL Adapter initialized\",\"parameters\":{\"pciVendorID\":32902,\"pciDeviceID\":32085,\"pciRevisionID\":8,\"pciSubSysID\":8453,\"pciSubSysVendorID\":7911,\"numEUsPerSubSlice\":16,\"numSubSlicesPerSlice\":3,\"numSlices\":2,\"frequency\":2200,\"xeCores\":7,\"driverVersion\":\"32.0.101.8974\",\"firmwareVersion\":\"22.0.1067.0\",\"deviceName\":\"Intel(R) Arc(TM) Graphics\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.130\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"IGCL Adapter initialized\",\"parameters\":{\"pciVendorID\":32902,\"pciDeviceID\":32085,\"pciRevisionID\":8,\"pciSubSysID\":8453,\"pciSubSysVendorID\":7911,\"numEUsPerSubSlice\":16,\"numSubSlicesPerSlice\":3,\"numSlices\":2,\"frequency\":2200,\"xeCores\":7,\"driverVersion\":\"32.0.101.8974\",\"firmwareVersion\":\"22.0.1067.0\",\"deviceName\":\"Intel(R) Arc(TM) Graphics\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.134\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"IGCL Adapter initialized\",\"parameters\":{\"pciVendorID\":32902,\"pciDeviceID\":32085,\"pciRevisionID\":8,\"pciSubSysID\":8453,\"pciSubSysVendorID\":7911,\"numEUsPerSubSlice\":16,\"numSubSlicesPerSlice\":3,\"numSlices\":2,\"frequency\":2200,\"xeCores\":7,\"driverVersion\":\"32.0.101.8974\",\"firmwareVersion\":\"22.0.1067.0\",\"deviceName\":\"Intel(R) Arc(TM) Graphics\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.209\t2\t{\"category\":\"ProfilesState\",\"level\":\"Information\",\"message\":\"LoadProfilesFromSettings: Count = 0\"}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.209\t2\t{\"category\":\"Navigation\",\"level\":\"Information\",\"message\":\"Reload/unload page\",\"parameters\":{\"caller\":\"OnSessionStateChanged\",\"sessionState\":\"Active\",\"mainWindowVisible\":\"False\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.210\t2\t{\"category\":\"Navigation\",\"level\":\"Information\",\"message\":\"Reload/unload page\",\"parameters\":{\"caller\":\"OnSessionStateChanged\",\"sessionState\":\"Active\",\"mainWindowVisible\":\"False\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.216\t2\t{\"category\":\"ProcessManager\",\"level\":\"Information\",\"message\":\"3rd Party\",\"parameters\":{\"library\":\"Process\",\"function\":\"Start\",\"action\":\"start\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.230\t2\t{\"category\":\"PresentMonWrapper\",\"level\":\"Information\",\"message\":\"Loaded PresentMonAPI2.dll\"}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.439\t2\t{\"category\":\"ProcessManager\",\"level\":\"Information\",\"message\":\"3rd Party\",\"parameters\":{\"library\":\"Process\",\"function\":\"Start\",\"action\":\"stop\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.460\t2\t{\"category\":\"DcaTelemetry\",\"level\":\"Information\",\"message\":\"App_Extension\",\"parameters\":{\"collectionEnabled\":false,\"status\":\"Entered\",\"value\":\"Performance\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.594\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.595\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.595\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.595\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.595\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.595\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.595\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.595\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.595\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.595\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.595\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.595\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.595\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.595\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.595\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.595\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.595\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.595\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.596\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.596\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.596\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.596\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.596\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.596\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.608\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.608\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.608\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.608\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.608\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.608\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.608\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.608\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.608\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.608\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.608\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.608\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.608\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.609\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.609\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.609\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.609\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.609\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.609\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.609\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.609\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.609\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.609\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.609\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.621\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.621\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.621\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.621\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.621\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.621\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.621\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.621\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.621\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.622\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.622\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.622\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.622\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.622\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.622\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.622\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.622\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.622\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.622\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.622\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.622\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.622\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.622\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.622\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.639\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.639\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.639\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.639\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.640\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.640\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.640\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.640\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.640\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.640\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.640\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.640\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.640\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.640\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.640\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.640\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.640\t2\t{\"category\":\"DcaTelemetry\",\"level\":\"Information\",\"message\":\"App_Extension\",\"parameters\":{\"collectionEnabled\":false,\"status\":\"Entered\",\"value\":\"PerformanceMetrics\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.640\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.640\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.640\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.640\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.641\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.641\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.641\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.641\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.650\t2\t{\"category\":\"WindowsDisplayManagerWrapper\",\"level\":\"Information\",\"message\":\"GetMonitorName 8388688: \"}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.656\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.656\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.656\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.656\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.657\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.657\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.657\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.657\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.657\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.657\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.657\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.657\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.657\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.657\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.657\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.657\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.657\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.657\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.657\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.657\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.658\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.658\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.658\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.658\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.666\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"Maximum display vrr range\",\"parameters\":{\"minVrrRefreshRate\":24,\"maxVrrRefreshRate\":120}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.669\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"Current Display vrr range\",\"parameters\":{\"minVrrRefreshRate\":30,\"maxVrrRefreshRate\":120}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.674\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.674\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.674\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.674\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.674\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.675\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.675\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.675\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.675\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.675\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.675\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.675\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.675\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.675\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.675\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.675\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.675\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.675\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.675\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.675\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.675\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.675\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.676\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.676\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.678\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - start\"}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.680\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - stop\"}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.680\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - start\"}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.680\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - stop\"}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.680\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - start\"}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.680\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - stop\"}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.681\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - start\"}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.681\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - stop\"}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.685\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"SupportedColorFormatAndDepth\",\"parameters\":{\"Display\":\"Internal\",\"Supported\":true,\"CurrentPixelFormat\":\"RGB\",\"CurrentColorDepth\":\"BPC_8\",\"PixelFormat RGB\":\"7FFC54E9D31C\",\"PixelFormat YCBCR_420\":\"7FFC54E9D314\",\"PixelFormat YCBCR_422\":\"7FFC54E9D314\",\"PixelFormat YCBCR_444\":\"7FFC54E9D314\",\"ColorDepth 6bpc\":\"7FFC54E9D314\",\"ColorDepth 8bpc\":\"7FFC54E9D31C\",\"ColorDepth 10bpc\":\"7FFC54E9D31C\",\"ColorDepth 12bpc\":\"7FFC54E9D314\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.700\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - start\"}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.700\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - stop\"}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.700\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - start\"}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.701\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - stop\"}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.705\t2\t{\"category\":\"CtlLibGraphicsController\",\"level\":\"Information\",\"message\":\"Graphics display: Internal - 8388688\"}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.740\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.740\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.740\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.740\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.740\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.740\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.740\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.740\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.740\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.740\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.740\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.740\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.740\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.740\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.741\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.741\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.741\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.741\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.741\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.741\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.741\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.741\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.741\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.741\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.806\t2\t{\"category\":\"WindowsDisplayManagerWrapper\",\"level\":\"Information\",\"message\":\"GetMonitorName 8388688: \"}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.855\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.876\t2\t{\"category\":\"DcaTelemetry\",\"level\":\"Information\",\"message\":\"PerformanceMetricsOverlay_Position\",\"parameters\":{\"collectionEnabled\":false,\"status\":\"Set\",\"value\":\"TopLeft\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.877\t2\t{\"category\":\"DcaTelemetry\",\"level\":\"Information\",\"message\":\"PerformanceMetricsOverlay_TargetAdapterPersistentId\",\"parameters\":{\"collectionEnabled\":false,\"status\":\"Set\",\"value\":\"\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.880\t2\t{\"category\":\"DcaTelemetry\",\"level\":\"Information\",\"message\":\"PerformanceMetricsOverlay_AdapterId\",\"parameters\":{\"collectionEnabled\":false,\"status\":\"Set\",\"value\":\"\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.881\t2\t{\"category\":\"DcaTelemetry\",\"level\":\"Information\",\"message\":\"PerformanceMetricsOverlay_TargetDisplayId\",\"parameters\":{\"collectionEnabled\":false,\"status\":\"Set\",\"value\":\"\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.941\t28017\tAppResolver Scan Started.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:29.981\t28018\tAppResolver Scan Stopped.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:29.983\t28019\tAppResolver Cache Committed.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:29.987\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:30.124\t42\t{\"category\":\"PresentMonWrapper\",\"level\":\"Information\",\"message\":\"Loaded PresentMonAPI2.dll\"}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:30.426\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:30.426\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:30.427\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:30.427\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:30.434\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:30.557\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:30.784\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:30.908\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:30.926\t9708\tFinished execution of command 'IntelGraphicsSoftware.exe\" -s' (PID 16176).\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:30.927\t9706\tFinished enumeration of commands for registry key 'Software\\Microsoft\\Windows\\CurrentVersion\\Run'.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:30.943\t9705\tStarted enumeration of commands for registry key 'Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce'.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:30.943\t9706\tFinished enumeration of commands for registry key 'Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce'.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:30.943\t9649\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:30.943\t9648\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:30.944\t9649\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:30.944\t9648\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:30.947\t9649\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:31.134\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:31.255\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:31.480\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:31.700\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:31.924\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:31.959\t254\tActivity Transfer\tInformation\tMicrosoft-Windows-WinRM/Operational\tMicrosoft-Windows-WinRM\n05.09.2026 08:29:31.959\t161\t\u041a\u043b\u0438\u0435\u043d\u0442\u0443 \u043d\u0435 \u0443\u0434\u0430\u0435\u0442\u0441\u044f \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0438\u0442\u044c\u0441\u044f \u043a \u0443\u0437\u043b\u0443 \u043d\u0430\u0437\u043d\u0430\u0447\u0435\u043d\u0438\u044f, \u0443\u043a\u0430\u0437\u0430\u043d\u043d\u043e\u043c\u0443 \u0432 \u0437\u0430\u043f\u0440\u043e\u0441\u0435. \u0423\u0431\u0435\u0434\u0438\u0442\u0435\u0441\u044c, \u0447\u0442\u043e \u0441\u043b\u0443\u0436\u0431\u0430 \u043d\u0430 \u0443\u0437\u043b\u0435 \u043d\u0430\u0437\u043d\u0430\u0447\u0435\u043d\u0438\u044f \u0440\u0430\u0431\u043e\u0442\u0430\u0435\u0442 \u0438 \u043f\u0440\u0438\u043d\u0438\u043c\u0430\u0435\u0442 \u0437\u0430\u043f\u0440\u043e\u0441\u044b. \u041e\u0437\u043d\u0430\u043a\u043e\u043c\u044c\u0442\u0435\u0441\u044c \u0441 \u0436\u0443\u0440\u043d\u0430\u043b\u0430\u043c\u0438 \u0438 \u0434\u043e\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u0446\u0438\u0435\u0439 \u0434\u043b\u044f \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0435\u043d\u0438\u044f \u0437\u0430\u043f\u0443\u0449\u0435\u043d\u043d\u043e\u0439 \u043d\u0430 \u0443\u0437\u043b\u0435 \u043d\u0430\u0437\u043d\u0430\u0447\u0435\u043d\u0438\u044f \u0441\u043b\u0443\u0436\u0431\u044b WS-Management (\u0447\u0430\u0449\u0435 \u0432\u0441\u0435\u0433\u043e \u044d\u0442\u043e IIS \u0438\u043b\u0438 WinRM). \u0415\u0441\u043b\u0438 \u044d\u0442\u043e \u0441\u043b\u0443\u0436\u0431\u0430 WinRM, \u0442\u043e \u0434\u043b\u044f \u0430\u043d\u0430\u043b\u0438\u0437\u0430 \u0441\u043e\u0441\u0442\u043e\u044f\u043d\u0438\u044f \u0438 \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0438 \u044d\u0442\u043e\u0439 \u0441\u043b\u0443\u0436\u0431\u044b \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0439\u0442\u0435 \u043d\u0430 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u043c \u0443\u0437\u043b\u0435 \u043a\u043e\u043c\u0430\u043d\u0434\u0443 \"winrm quickconfig\".\tError\tMicrosoft-Windows-WinRM/Operational\tMicrosoft-Windows-WinRM\n05.09.2026 08:29:31.959\t142\tWSMan operation Enumeration failed, error code 2150858770\tError\tMicrosoft-Windows-WinRM/Operational\tMicrosoft-Windows-WinRM\n05.09.2026 08:29:31.980\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-544\n\tGroup Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u044b\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x25e8\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:31.981\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-551\n\tGroup Name:\t\t\u041e\u043f\u0435\u0440\u0430\u0442\u043e\u0440\u044b \u0430\u0440\u0445\u0438\u0432\u0430\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x25e8\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:32.015\t3\t\"The BITS service created a new job.\nTransfer job: Yupdate-task\nJob ID: {a9ba6902-5270-40a5-8951-0fc967a4de1c}\nOwner: HONOR-FRG-X\\admin\nProcess Path: C:\\Users\\admin\\AppData\\Local\\Yandex\\Punto Switcher\\punto.exe\nProcess ID: 16120\"\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 08:29:32.022\t16403\t\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 08:29:32.024\t6\tCommand-line command set for job {a9ba6902-5270-40a5-8951-0fc967a4de1c} with owner HONOR-FRG-X\\admin. Program: C:\\Users\\admin\\AppData\\Local\\Yandex\\Punto Switcher\\Updater\\yupdate.exe Args: C:\\Users\\admin\\AppData\\Local\\Yandex\\Punto Switcher\\Updater\\yupdate.exe  --stat-callback 0 --appid punto --job {A9BA6902-5270-40A5-8951-0FC967A4DE1C}.\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 08:29:32.072\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.072\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.072\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.072\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.072\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.072\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.072\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.072\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.072\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.072\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.072\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.072\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.072\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.072\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.072\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.072\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.073\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.073\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.073\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.073\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.073\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.073\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.073\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.073\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.191\t310\tThe initialization of the peer helper modules failed with the following error:  0x80070032.\tWarning\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 08:29:32.195\t59\tBITS started the Yupdate-task transfer job that is associated with the http://soft.export.yandex.ru/status.xml?yasoft=punto&clid=1551207&ui={EB66A6CA-1EF6-4210-8E2E-D6D3B48CAC9D}&ver=4.5.0.583&os=win&stat=dayuse&ch=1&launchesAsAdmin=0&os=win10x64&osver=win10x64&usesAutocorrection=0&usesDiary=0&uv=1.2.0.1831&ww=1&fd=19.05.2026 URL.\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 08:29:32.248\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:32.270\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:32.271\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:32.282\t60\tBITS stopped transferring the Yupdate-task transfer job that is associated with the http://soft.export.yandex.ru/status.xml?yasoft=punto&clid=1551207&ui={EB66A6CA-1EF6-4210-8E2E-D6D3B48CAC9D}&ver=4.5.0.583&os=win&stat=dayuse&ch=1&launchesAsAdmin=0&os=win10x64&osver=win10x64&usesAutocorrection=0&usesDiary=0&uv=1.2.0.1831&ww=1&fd=19.05.2026 URL. The status code is 0x0.\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 08:29:32.341\t4\t\"The transfer job is complete.\nUser: HONOR-FRG-X\\admin\nTransfer job: Yupdate-task\nJob ID: {a9ba6902-5270-40a5-8951-0fc967a4de1c}\nOwner: HONOR-FRG-X\\admin\nFile count: 1\"\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 08:29:32.357\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:32.408\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:32.434\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"IGCL Adapter initialized\",\"parameters\":{\"pciVendorID\":32902,\"pciDeviceID\":32085,\"pciRevisionID\":8,\"pciSubSysID\":8453,\"pciSubSysVendorID\":7911,\"numEUsPerSubSlice\":16,\"numSubSlicesPerSlice\":3,\"numSlices\":2,\"frequency\":2200,\"xeCores\":7,\"driverVersion\":\"32.0.101.8974\",\"firmwareVersion\":\"22.0.1067.0\",\"deviceName\":\"Intel(R) Arc(TM) Graphics\"}}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.441\t42\t{\"category\":\"CtlLibGraphicsController\",\"level\":\"Information\",\"message\":\"Graphics adapter: Intel(R) Arc(TM) Graphics\"}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.446\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"IGCL Adapter initialized\",\"parameters\":{\"pciVendorID\":32902,\"pciDeviceID\":32085,\"pciRevisionID\":8,\"pciSubSysID\":8453,\"pciSubSysVendorID\":7911,\"numEUsPerSubSlice\":16,\"numSubSlicesPerSlice\":3,\"numSlices\":2,\"frequency\":2200,\"xeCores\":7,\"driverVersion\":\"32.0.101.8974\",\"firmwareVersion\":\"22.0.1067.0\",\"deviceName\":\"Intel(R) Arc(TM) Graphics\"}}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.446\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"IGCL Adapter initialized\",\"parameters\":{\"pciVendorID\":32902,\"pciDeviceID\":32085,\"pciRevisionID\":8,\"pciSubSysID\":8453,\"pciSubSysVendorID\":7911,\"numEUsPerSubSlice\":16,\"numSubSlicesPerSlice\":3,\"numSlices\":2,\"frequency\":2200,\"xeCores\":7,\"driverVersion\":\"32.0.101.8974\",\"firmwareVersion\":\"22.0.1067.0\",\"deviceName\":\"Intel(R) Arc(TM) Graphics\"}}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.495\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"IGCL Adapter initialized\",\"parameters\":{\"pciVendorID\":32902,\"pciDeviceID\":32085,\"pciRevisionID\":8,\"pciSubSysID\":8453,\"pciSubSysVendorID\":7911,\"numEUsPerSubSlice\":16,\"numSubSlicesPerSlice\":3,\"numSlices\":2,\"frequency\":2200,\"xeCores\":7,\"driverVersion\":\"32.0.101.8974\",\"firmwareVersion\":\"22.0.1067.0\",\"deviceName\":\"Intel(R) Arc(TM) Graphics\"}}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.501\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"IGCL Adapter initialized\",\"parameters\":{\"pciVendorID\":32902,\"pciDeviceID\":32085,\"pciRevisionID\":8,\"pciSubSysID\":8453,\"pciSubSysVendorID\":7911,\"numEUsPerSubSlice\":16,\"numSubSlicesPerSlice\":3,\"numSlices\":2,\"frequency\":2200,\"xeCores\":7,\"driverVersion\":\"32.0.101.8974\",\"firmwareVersion\":\"22.0.1067.0\",\"deviceName\":\"Intel(R) Arc(TM) Graphics\"}}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.526\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:32.760\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"Maximum display vrr range\",\"parameters\":{\"minVrrRefreshRate\":24,\"maxVrrRefreshRate\":120}}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.763\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"Current Display vrr range\",\"parameters\":{\"minVrrRefreshRate\":30,\"maxVrrRefreshRate\":120}}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.774\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - start\"}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.776\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - stop\"}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.776\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - start\"}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.776\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - stop\"}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.777\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - start\"}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.777\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - stop\"}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.777\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - start\"}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.777\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - stop\"}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.780\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:32.784\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"SupportedColorFormatAndDepth\",\"parameters\":{\"Display\":\"Internal\",\"Supported\":true,\"CurrentPixelFormat\":\"RGB\",\"CurrentColorDepth\":\"BPC_8\",\"PixelFormat RGB\":\"7FFC54E9D31C\",\"PixelFormat YCBCR_420\":\"7FFC54E9D314\",\"PixelFormat YCBCR_422\":\"7FFC54E9D314\",\"PixelFormat YCBCR_444\":\"7FFC54E9D314\",\"ColorDepth 6bpc\":\"7FFC54E9D314\",\"ColorDepth 8bpc\":\"7FFC54E9D31C\",\"ColorDepth 10bpc\":\"7FFC54E9D31C\",\"ColorDepth 12bpc\":\"7FFC54E9D314\"}}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.805\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - start\"}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.805\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - stop\"}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.806\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - start\"}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.806\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - stop\"}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.812\t42\t{\"category\":\"CtlLibGraphicsController\",\"level\":\"Information\",\"message\":\"Graphics display: Internal - 8388688\"}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.919\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:33.059\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:33.207\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:33.351\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:33.499\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:33.639\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:33.783\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:33.927\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:33.936\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:33.936\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:33.936\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:34.067\t26\tWindows Update successfully found 0 updates.\tInformation\tMicrosoft-Windows-WindowsUpdateClient/Operational\tMicrosoft-Windows-WindowsUpdateClient\n05.09.2026 08:29:34.072\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:34.215\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:34.268\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:34.304\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:34.309\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:34.309\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:34.369\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:34.518\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:34.649\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:34.798\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:34.939\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:35.082\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:35.092\t16384\tSuccessfully scheduled Software Protection service for re-start at 2126-08-12T01:29:35Z. Reason: RulesEngine.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 08:29:35.099\t903\t\"The Software Protection service has stopped.\n\"\tUndefined\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 08:29:35.198\t8001\t\"Skipping license manager: PFN A-Volute.Nahimic_1.10.13.0_x64__w2gh52qy24etm\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:35.199\t8001\t\"Skipping license manager: PFN A-Volute.Nahimic_1.10.13.0_x64__w2gh52qy24etm\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:35.229\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:35.396\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:35.651\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:35.893\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:35.893\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:35.893\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:35.906\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:35.907\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:36.159\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:36.305\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:36.471\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:36.527\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:36.528\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:36.528\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:36.621\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:36.763\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:36.909\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:37.157\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:37.308\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:37.563\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:37.816\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:37.964\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:38.030\t1027\t\"ReadyBoot has updated the system volume unique ID: 0x82589128D7020000B8CF8787E80000000400000000000000\n ErrorCode: 0x0\"\tInformation\tMicrosoft-Windows-ReadyBoost/Operational\tMicrosoft-Windows-ReadyBoost\n05.09.2026 08:29:38.219\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:38.381\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:38.538\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:38.694\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:38.952\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:39.112\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:39.268\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:39.432\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:39.586\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:39.742\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:39.997\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:40.143\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:40.289\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:40.451\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:40.609\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:40.762\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:40.904\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:41.053\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:41.202\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:41.359\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:41.516\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:41.765\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:41.917\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:42.173\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:42.429\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:42.684\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:42.941\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:43.193\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:43.340\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:43.588\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:43.740\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:43.896\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:44.039\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:44.184\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:44.327\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:44.475\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:44.732\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:44.984\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:45.125\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:45.275\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:45.295\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:45.295\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:45.300\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:45.300\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:45.529\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:45.673\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:45.824\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:45.980\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:46.235\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:46.490\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:46.631\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:46.776\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:47.028\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:47.176\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:47.256\t256\t[14724:14840:0905/082947.247:INFO:chrome\\browser\\extensions\\extension_garbage_collector.cc:188] Garbage collection for extensions on file thread is complete.\tInformation\tApplication\tChrome\n05.09.2026 08:29:47.322\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:47.322\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:47.422\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:47.451\t265\t1 predictions were fetched for transforms '' and PCRs 7,11. USN: 0, Matching PCRs: 1,2,3,4,5,6,7,8,9,10,11.\tInformation\tMicrosoft-Windows-PCRPF/PCRPF\tMicrosoft-Windows-PCRPF\n05.09.2026 08:29:47.568\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:47.712\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:47.869\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:48.010\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:48.153\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:48.301\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:48.341\t1113\tDevice Compact Ticket request completed with Device Id 00180018E4F8342E for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:48.341\t1205\tWNP Transport Layer Disconnect call initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:48.551\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:48.695\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:48.865\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:49.011\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:49.155\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:49.295\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:49.444\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:49.519\t1015\t\"Summary of ReadyBoot Performance:\n     Io Read Count: 80015\n     Io Read Bytes: 2961868800\n     Cache Hit Count: 68900\n     Cache Hit Bytes: 1361488896\n     Cache Hit Percentage: 86.1088545897644\n     Boot Prefetch Time (us): 5546339\n     Boot Prefetch Bytes: 1660579840\n     Boot Prefetch Read Count: 40917\n     Flags: 98\n     Sync Prefetch IO Bytes: 0\n     Sync Prefetch IO Count: 0\n     Sync Prefetch Duration (us): 1\n     Post Sync Phase Pend Count: 12\n\"\tInformation\tMicrosoft-Windows-ReadyBoost/Operational\tMicrosoft-Windows-ReadyBoost\n05.09.2026 08:29:49.703\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:49.855\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:50.014\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:50.267\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:50.520\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:50.665\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:50.807\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:50.858\t1016\t\"Boot plan calculation completed in 2406 ms.\n     Boot Plan Timestamp: \u200e2026\u200e-\u200e09\u200e-\u200e05T08:29:48.432219400Z\n     Reason: System boot completion\n     Result: 0x0\"\tInformation\tMicrosoft-Windows-ReadyBoost/Operational\tMicrosoft-Windows-ReadyBoost\n05.09.2026 08:29:50.953\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:51.096\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:51.244\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:51.498\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:51.642\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:51.784\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:51.840\t1005\tThe Connection Provider status changed to Disconnected.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:51.840\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:51.840\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:51.847\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:51.852\t1113\tDevice Compact Ticket request completed with Device Id 00180018E4F8342E for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:51.863\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:51.864\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:51.864\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:51.931\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:52.186\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:52.332\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:52.489\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:52.635\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:52.888\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:53.030\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:53.177\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:53.321\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:53.466\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:53.613\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:53.866\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:54.012\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:54.266\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:54.411\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:54.557\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:54.807\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:54.955\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:55.211\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:55.465\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:55.613\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:55.869\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:56.124\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:56.375\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:56.520\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:56.664\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:56.807\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:56.957\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:57.207\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:57.354\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:57.497\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:57.551\t61\tIs the Battery Saver state enabled: false\tInformation\tMicrosoft-Windows-UniversalTelemetryClient/Operational\tMicrosoft-Windows-UniversalTelemetryClient\n05.09.2026 08:29:57.648\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:57.800\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:57.941\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:58.093\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:58.240\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:58.385\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:58.634\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:58.781\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:59.034\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:59.178\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:59.317\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:59.465\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:59.608\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:59.750\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:59.894\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:00.043\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:00.296\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:00.441\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:00.579\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:00.639\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:00.639\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:00.641\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:00.641\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:00.732\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:00.982\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:01.128\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:01.274\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:01.437\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:01.471\t37\tThe speed of processor 5 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report.\tWarning\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:30:01.487\t37\tThe speed of processor 9 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report.\tWarning\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:30:01.614\t37\tThe speed of processor 17 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report.\tWarning\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:30:01.688\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:01.834\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:01.977\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:02.118\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:02.266\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:02.321\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, Cimwin32A, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:30:02.322\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, MS_NT_EVENTLOG_PROVIDER, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:30:02.406\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:02.551\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:02.700\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:02.951\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:03.094\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:03.240\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:03.383\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:03.526\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:03.670\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:03.819\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:04.071\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:04.195\t1\tTenant P-ARIA-6660cc65b74b4291b30536aea7ed6ead-5a228f6e-723e-4098-8ed2-3554f184fd67-7451 has been registered for telemetry usage.\tInformation\tMicrosoft-Windows-UniversalTelemetryClient/Operational\tMicrosoft-Windows-UniversalTelemetryClient\n05.09.2026 08:30:04.212\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:04.359\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:04.504\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:04.647\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:04.792\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:04.938\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:05.083\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:05.222\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:05.368\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:05.511\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:05.556\t8100\tStarting validation and setting the Trust Label on package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:30:05.557\t8106\tPackage Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe has Trust Label already. Flags: 0x103\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:30:05.557\t8101\tFinished validation and setting the Trust Label on package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:30:05.652\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:05.803\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:06.059\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:06.203\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:06.457\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:06.596\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:06.741\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:06.883\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:07.029\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:07.170\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:07.322\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:07.462\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:07.606\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:07.748\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:07.897\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:08.043\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:08.295\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:08.442\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:08.585\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:08.730\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:09.004\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:09.155\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:09.295\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:09.417\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:09.417\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:09.417\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:09.422\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:09.441\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:09.587\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:09.731\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:09.735\t8001\t\"Skipping license manager: PFN Microsoft.WindowsFeedbackHub_2.2606.702.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.736\t8001\t\"Skipping license manager: PFN Microsoft.WindowsFeedbackHub_2.2606.702.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.738\t8001\t\"Skipping license manager: PFN Microsoft.StorePurchaseApp_22605.1401.3.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.741\t8001\t\"Skipping license manager: PFN Microsoft.WindowsStore_22606.1401.6.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.741\t8001\t\"Invoking license manager because license/lease polling time up: PFN A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (361)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.741\t8001\t\"ServiceBeginAcquireLicenseImpl PsmKey:A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6+App, IsSystemUsage:1\nFunction: ServiceBeginAcquireLicenseImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2304)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.742\t8002\t\"Failure Message: hr: 0x800703f0\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2324)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.742\t8001\t\"Skipping license manager: PFN Microsoft.WindowsStore_22606.1401.6.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.743\t8001\t\"Failure Message: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp(2324)\\LicenseManager.dll!00007FFBF486A702: (caller: 00007FFBF525134D) Exception(2) tid(3564) 800703F0 \u041f\u043e\u043f\u044b\u0442\u043a\u0430 \u0441\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u043d\u0435\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0439 \u0442\u043e\u043a\u0435\u043d.\n\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2348)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.743\t8001\t\"ServiceBeginAcquireLicenseImpl PsmKey:A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6+App, IsSystemUsage:1\nFunction: ServiceBeginAcquireLicenseImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2304)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.743\t8002\t\"Failure Message: hr: 0x800703f0\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2324)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.744\t8001\t\"Failure Message: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp(2324)\\LicenseManager.dll!00007FFBF486A702: (caller: 00007FFBF525134D) Exception(3) tid(3564) 800703F0 \u041f\u043e\u043f\u044b\u0442\u043a\u0430 \u0441\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u043d\u0435\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0439 \u0442\u043e\u043a\u0435\u043d.\n\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2348)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.744\t8001\t\"ServiceBeginAcquireLicenseImpl PsmKey:A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6+App, IsSystemUsage:1\nFunction: ServiceBeginAcquireLicenseImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2304)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.746\t8001\t\"Skipping license manager: PFN A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.749\t8001\t\"Licensing package A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6 (3)\nFunction: OneStoreApplicationLicenseManager::GetLicenseForInstalledPackage\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\onestoreapplicensemanager.cpp (120)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.749\t8001\t\"Licensing 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A (Active)\nFunction: LicenseManager::LicenseContentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\manager.cpp (88)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.749\t8001\t\"0000021F831D39B0: Key Machine for content: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\nFunction: KeyMachine::KeyMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (95)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.749\t8011\t0x21f83133e68: 13728: RootMachine: Dispatch: Root:Connect => Root:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.749\t8011\t0x21f831d39d0: 13728: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A: Dispatch: Key:Activate => Key:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.749\t8001\t\"0000021F831D39B0: BeginLicense: Operation 3, CachedLeaseOK true, RequireServiceValidation false\nFunction: KeyMachine::DoBeginLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (819)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.749\t8012\t0x21f831d39d0: 13728: Key:Initial Change: Key:NegotiatingUnleased => 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.751\t8001\t\"Considering License ID {DE7849EA-B8E4-60D1-C780-7B0969A99E76} for content ID 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.751\t8001\t\"Decoding: {\"\"legacyProductId\"\":\"\"b7757af6-9e6d-4d21-8272-c9137a2e9145\"\"}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.751\t8001\t\"Accepting key with License ID {DE7849EA-B8E4-60D1-C780-7B0969A99E76} for Content ID 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A (first match)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (223)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.751\t8001\t\"Returning key document for contentid 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (262)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.752\t8001\t\"Getting lease for 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\nFunction: LicenseManagerCore::GetExistingLeaseAndLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (415)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.756\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2be1da80-9d39-1a56-8b4b-dca10f958cc2\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=80daf1f6-7afc-6d23-2c3c-f1e0a663029a&entitlementId=2be1da80-9d39-1a56-8b4b-dca10f958cc2&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"de7849ea-b8e4-60d1-c780-7b0969a99e76\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"80daf1f6-7afc-6d23-2c3c-f1e0a663029a\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NBLGGH0CB6D\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-09-04T15:27:12.2174791+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.756\t8001\t\"Adding lease {941FBCC0-EC32-D9CB-EB46-FC3AE38EC79B} to results\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (387)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.756\t8001\t\"Returning 1 lease documents for contentid 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.756\t8001\t\"lease = 0x83178a28, usage = 268435456, policy = 1, operation = 3, leaseBehavior = 0, shouldContentBeDeactivated = 0\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (905)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.756\t8011\t0x21f831d39d0: 13732: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A: Dispatch: Key:@LicenseDone => Key:NegotiatingUnleased\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.760\t8001\t\"lease = 0x83178a28, leaseActive = 1, leaseBehavior = 0\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1986)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.760\t8001\t\"Lease Machine: 0000021F8312B600: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\nFunction: LeaseMachine::LeaseMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (40)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.760\t8001\t\"Set results for lease = 0x83178a28, policy = 1, operation = 3, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.760\t8011\t0x21f8312b620: 13728: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}: Dispatch: Lease:UpdateLeaseDocument => Lease:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.760\t8012\t0x21f8312b620: 13728: Lease:Initial Change: Lease:Valid => {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.760\t8001\t\"No cached lease or key found, not renewing with service and treating this as a valid license with lease = 0x83178a28\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (2032)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.760\t8012\t0x21f831d39d0: 13732: Key:NegotiatingUnleased Change: Key:Valid => 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.760\t8001\t\"Decoding: {\"\"legacyProductId\"\":\"\"b7757af6-9e6d-4d21-8272-c9137a2e9145\"\"}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.760\t8011\t0x21f831d39d0: 13732: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A: Dispatch: Key:RegisterCallback => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.760\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2be1da80-9d39-1a56-8b4b-dca10f958cc2\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=80daf1f6-7afc-6d23-2c3c-f1e0a663029a&entitlementId=2be1da80-9d39-1a56-8b4b-dca10f958cc2&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"de7849ea-b8e4-60d1-c780-7b0969a99e76\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"80daf1f6-7afc-6d23-2c3c-f1e0a663029a\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NBLGGH0CB6D\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-09-04T15:27:12.2174791+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.760\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2be1da80-9d39-1a56-8b4b-dca10f958cc2\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=80daf1f6-7afc-6d23-2c3c-f1e0a663029a&entitlementId=2be1da80-9d39-1a56-8b4b-dca10f958cc2&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"de7849ea-b8e4-60d1-c780-7b0969a99e76\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"80daf1f6-7afc-6d23-2c3c-f1e0a663029a\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NBLGGH0CB6D\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-09-04T15:27:12.2174791+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.760\t8001\t\"ReactiveLicensingResult: 0x00000000 for A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6, 32ms\nFunction: LogReactiveLicensingResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\telemetry.cpp (512)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.760\t8001\t\"Updating lease timer for {1173A7B1-89F2-09CC-0563-CDED7D7397B9} to expire @ 2026-09-05T01:51:27Z (jitter was 21.295341 minutes)\nFunction: LeaseMachine::DoUpdateLeaseTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (276)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.760\t8001\t\"Added timer for {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\nFunction: MemoryTimerService::CreateTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (57)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.760\t8011\t0x21f8312b620: 13728: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}: Dispatch: Lease:AddKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.763\t505\t\"Compatibility fix applied to C:\\WINDOWS\\system32\\backgroundTaskHost.exe.\nFix information: Microsoft Apps, {81ecdb97-5112-41af-9a59-5ba9444f4270}, 0x80010101.\"\tInformation\tMicrosoft-Windows-Application-Experience/Program-Telemetry\tMicrosoft-Windows-Application-Experience\n05.09.2026 08:30:09.776\t505\t\"Compatibility fix applied to C:\\WINDOWS\\system32\\backgroundTaskHost.exe.\nFix information: \u042f\u043d\u0434\u0435\u043a\u0441.\u041c\u0443\u0437\u0438\u043a\u0430, {071f875e-406c-4938-beaa-65f69cc573e2}, 0x80010101.\"\tInformation\tMicrosoft-Windows-Application-Experience/Program-Telemetry\tMicrosoft-Windows-Application-Experience\n05.09.2026 08:30:09.785\t1239\tWNP Keep Alive Detector starting KA measurement with value: 1680 seconds; type: Converged; Min Limit: 60 seconds\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:09.789\t210\tCreated Desktop AppX container {245CDBFE-A8C9-11F1-B7FF-289200F24A99} for package MSTeams_26093.415.4620.1935_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:30:09.789\t211\tAdded process 15228 to Desktop AppX container 245cdbfe-a8c9-11f1-b7ff-289200f24a99 for package MSTeams_26093.415.4620.1935_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:30:09.800\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:09.801\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:09.801\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:09.803\t505\t\"Compatibility fix applied to C:\\WINDOWS\\system32\\backgroundTaskHost.exe.\nFix information: Microsoft Apps, {81ecdb97-5112-41af-9a59-5ba9444f4270}, 0x80010101.\"\tInformation\tMicrosoft-Windows-Application-Experience/Program-Telemetry\tMicrosoft-Windows-Application-Experience\n05.09.2026 08:30:09.838\t505\t\"Compatibility fix applied to C:\\WINDOWS\\system32\\backgroundTaskHost.exe.\nFix information: Microsoft Apps, {81ecdb97-5112-41af-9a59-5ba9444f4270}, 0x80010101.\"\tInformation\tMicrosoft-Windows-Application-Experience/Program-Telemetry\tMicrosoft-Windows-Application-Experience\n05.09.2026 08:30:09.939\t2002\t\"Windows::Services::Store::StoreContextFactory::GetDefault() invoked. (CV:exbuXxFHwECWL3f3.4)\nError: Unknown HResult Error code: 0xefffffff\nFunction: Windows::Services::Store::StoreContextFactory::GetDefault\nSource: onecoreuap\\enduser\\winstore\\licensing\\winrt\\lib\\storecontext.cpp (63)\"\tInformation\tMicrosoft-Windows-Store/Operational\tWindows-ApplicationModel-Store-SDK\n05.09.2026 08:30:09.949\t8011\t0x21f83178e90: 13668: EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED: Dispatch: Key:Connect => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.949\t8001\t\"Decoding: {\"\"legacyProductId\"\":\"\"6ead4a77-d076-4866-9188-621a5b1f414f\"\"}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.949\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"200dc622-8cbd-e337-4d4b-69d2fa6e7df7\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966575679381420&contentId=eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed&entitlementId=200dc622-8cbd-e337-4d4b-69d2fa6e7df7&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"0f8e2cd5-b8eb-7a22-b9e9-9b1183fa0a84\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NMPJ99VJBWV\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-08-04T14:54:13.8630559+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.949\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"200dc622-8cbd-e337-4d4b-69d2fa6e7df7\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966575679381420&contentId=eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed&entitlementId=200dc622-8cbd-e337-4d4b-69d2fa6e7df7&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"0f8e2cd5-b8eb-7a22-b9e9-9b1183fa0a84\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NMPJ99VJBWV\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-08-04T14:54:13.8630559+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.950\t2002\t\"StoreContextServer::Initialize: packageFullName = Microsoft.YourPhone_1.26071.164.0_x64__8wekyb3d8bbwe, productStoreId = 9NMPJ99VJBWV, isLicensed = true, isAppContainer = false\nError: Unknown HResult Error code: 0xefffffff\nFunction: Windows::Services::Store::Internal::StoreContextServer::_InitializeImpl\nSource: onecoreuap\\enduser\\winstore\\licensing\\winrt\\lib\\windows\\storecontextserver.cpp (1159)\"\tInformation\tMicrosoft-Windows-Store/Operational\tWindows-ApplicationModel-Store-SDK\n05.09.2026 08:30:09.950\t2002\t\"Windows::Services::Store::StoreContext::GetAppAndOptionalStorePackageUpdatesAsync invoked. (CV:exbuXxFHwECWL3f3.4.3)\nError: Unknown HResult Error code: 0xefffffff\nFunction: Windows::Services::Store::StoreContext::GetAppAndOptionalStorePackageUpdatesAsync\nSource: onecoreuap\\enduser\\winstore\\licensing\\winrt\\lib\\storecontext.cpp (1403)\"\tInformation\tMicrosoft-Windows-Store/Operational\tWindows-ApplicationModel-Store-SDK\n05.09.2026 08:30:09.952\t2002\t\"Adding calling package = Microsoft.YourPhone_8wekyb3d8bbwe for productId = 9NMPJ99VJBWV\nError: Unknown HResult Error code: 0xefffffff\nFunction: Windows::Services::Store::Internal::StoreContextServer::GetAppAndOptionalStorePackageUpdates\nSource: onecoreuap\\enduser\\winstore\\licensing\\winrt\\lib\\windows\\storecontextserver.cpp (3491)\"\tInformation\tMicrosoft-Windows-Store/Operational\tWindows-ApplicationModel-Store-SDK\n05.09.2026 08:30:09.987\t2006\t\"request: addAsPaused = true, clientID = PhoneExperienceHost, CV = exbuXxFHwECWL3f3.4.3.1.2\nError: Unknown HResult Error code: 0xefffffff\nFunction: Windows::ApplicationModel::Store::Preview::InstallControl::AppInstallManagerImpl::SearchForUpdatesWithPausedAddAsync\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\appinstallcontrol.cpp (4726)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:30:09.987\t2006\t\"Checking interactive for update for scan caller: PhoneExperienceHost-SearchForUpdatesWithPausedAddAsync\nError: Unknown HResult Error code: 0xefffffff\nFunction: Utils::IsCallerInteractive\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\utils.cpp (385)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:30:09.988\t2006\t\"Checking if top-level window is visible for PhoneExperienceHost-SearchForUpdatesWithPausedAddAsync, setting userInteractive = false\nError: Unknown HResult Error code: 0xefffffff\nFunction: Utils::IsCallerInteractive\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\utils.cpp (427)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:30:09.991\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:09.991\t2006\t\"Scan allowed inside interval for Microsoft.YourPhone_8wekyb3d8bbwe. Current last scan time cache: 2026-09-04T11:58:29+07:00;2026-09-04T12:02:46+07:00;2026-09-04T16:47:41+07:00;2026-09-05T08:29:25+07:00;2026-09-05T08:30:09+07:00\nError: Unknown HResult Error code: 0xefffffff\nFunction: OnlineScanAllowedInInterval\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\stringhelpers.cpp (479)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:30:09.993\t2006\t\"Last scan time calculated, setting online = 1\nError: Unknown HResult Error code: 0xefffffff\nFunction: GetIsOnlineScanAllowed\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\uwainstallworkbridge.cpp (2374)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:30:09.994\t2006\t\"[Telemetry]: BeginScanForUpdates :: _TlgCV_ = exbuXxFHwECWL3f3.4.3.1.2.0.1 \u00a0IsOnline = true \u00a0IsApplicability = false \u00a0ClientAppId = Update;PhoneExperienceHost-SearchForUpdatesWithPausedAddAsync \u00a0IsInteractive = false \u00a0\nError: Unknown HResult Error code: 0xefffffff\nFunction: LogTelemetryEvent\nSource: onecoreuap\\enduser\\winstore\\installservice\\svc\\logging.cpp (10)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:30:10.137\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:10.285\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:10.434\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:10.459\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:30:10.459\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:30:10.491\t1002\tError 0x80070005 occurred while verifying known folder {62ab5d82-fdc1-4dc3-a9dd-070d1d495d97} with path 'C:\\ProgramData'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:30:10.600\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:10.756\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:10.913\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:11.058\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:11.113\t5382\t\"Vault credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nThis event occurs when a user reads a stored vault credential.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:30:11.130\t5382\t\"Vault credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nThis event occurs when a user reads a stored vault credential.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:30:11.197\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:11.333\t8001\t\"Skipping license manager: PFN Microsoft.DesktopAppInstaller_1.29.290.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:11.349\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:11.361\t210\tCreated Desktop AppX container {245CDC17-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.DesktopAppInstaller_1.29.290.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:30:11.361\t211\tAdded process 16560 to Desktop AppX container 245cdc17-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.DesktopAppInstaller_1.29.290.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:30:11.511\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:11.663\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:11.787\t217\tDestroyed Desktop AppX container {245CDBFE-A8C9-11F1-B7FF-289200F24A99} for package MSTeams_26093.415.4620.1935_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:30:11.817\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:11.957\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:12.103\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:12.249\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:12.498\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:12.636\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:12.782\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:12.858\t2006\t\"WU scan found 0 packages\nError: Unknown HResult Error code: 0xefffffff\nFunction: _PackagesFromSearchResult\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\wuhelpers.cpp (157)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:30:12.858\t2006\t\"[Telemetry]: EndScanForUpdates :: _TlgCV_ = exbuXxFHwECWL3f3.4.3.1.2.0.1 \u00a0IsOnline = true \u00a0IsApplicability = false \u00a0IsInteractive = false \u00a0ClientAppId = Update;PhoneExperienceHost-SearchForUpdatesWithPausedAddAsync \u00a0NumberOfApplicableUpdates = 0 \u00a0AutoUpdateWorkScheduledWithUOTime =  \u00a0PFN = (null) \u00a0HResult = 0 \u00a0\nError: Unknown HResult Error code: 0xefffffff\nFunction: LogTelemetryEvent\nSource: onecoreuap\\enduser\\winstore\\installservice\\svc\\logging.cpp (10)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:30:12.858\t2006\t\"No updates found. CategoryIds Count = 1 \u00a0\nError: The operation completed successfully.\nFunction: ScanForMultipleUpdates\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\uwainstallworkbridge.cpp (2138)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:30:12.860\t2002\t\"Windows::Services::Store::StoreContext::get_CanSilentlyDownloadStorePackageUpdates() invoked. (CV:exbuXxFHwECWL3f3.4.5)\nError: Unknown HResult Error code: 0xefffffff\nFunction: Windows::Services::Store::StoreContext::get_CanSilentlyDownloadStorePackageUpdates\nSource: onecoreuap\\enduser\\winstore\\licensing\\winrt\\lib\\storecontext.cpp (1732)\"\tInformation\tMicrosoft-Windows-Store/Operational\tWindows-ApplicationModel-Store-SDK\n05.09.2026 08:30:12.924\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:13.065\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:13.209\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:13.350\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:13.367\t5382\t\"Vault credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nThis event occurs when a user reads a stored vault credential.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:30:13.369\t5382\t\"Vault credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nThis event occurs when a user reads a stored vault credential.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:30:13.375\t2000\t\"Process Name: C:\\WINDOWS\\system32\\backgroundTaskHost.exe\nModule Name: C:\\Windows\\System32\\InstallService.dll\nBuild: 26100.1.amd64fre.ge_release.240331-1435, UBR: 9168\n\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:30:13.375\t2006\t\"Setting MSA Client Id for Token requests: {f0c62012-2cef-4831-b1f7-930682874c86}\nError: Unspecified error\nFunction: \nSource: onecoreuap\\enduser\\winstore\\auth\\lib\\winstoreauth.cpp (206)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:30:13.448\t2005\t\"oneSettingsconcurrentDefaultInstalls = 3, oneSettingsconcurrentMinInstalls = 3\nError: Unknown HResult Error code: 0xefffffff\nFunction: GetConcurrentInstallsFromOneSettings\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (763)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:30:13.459\t2006\t\"request: Microsoft.WindowsStore CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US\nError: Unknown HResult Error code: 0xefffffff\nFunction: Windows::ApplicationModel::Store::Preview::InstallControl::AppInstallManagerImpl::IsStoreBlockedByPolicyAsync\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\appinstallcontrol.cpp (1995)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:30:13.460\t2006\t\"result: Microsoft.WindowsStore, CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US, blocked = false\nError: The operation completed successfully.\nFunction: Windows::ApplicationModel::Store::Preview::InstallControl::AppInstallManagerImpl::IsStoreBlockedByPolicyAsync::::operator ()\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\appinstallcontrol.cpp (2026)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:30:13.490\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:13.641\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:13.781\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:13.927\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:14.069\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:14.217\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:14.359\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:14.502\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:14.649\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:14.794\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:14.936\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:15.079\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:15.228\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:15.481\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:15.624\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:15.769\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:15.912\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:16.053\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:16.197\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:16.346\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:16.593\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:16.740\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:16.914\t3\t\"The BITS service created a new job.\nTransfer job: Chrome Component Updater\nJob ID: {df57cb3c-61e4-42c9-af52-ac0b58945dbd}\nOwner: HONOR-FRG-X\\admin\nProcess Path: C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe\nProcess ID: 14724\"\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 08:30:16.918\t16403\t\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 08:30:16.990\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:17.135\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:17.203\t59\tBITS started the Chrome Component Updater transfer job that is associated with the http://edgedl.me.gvt1.com/edgedl/diffgen-puffin/efniojlnjndmcbiieegkicadnoecjjef/ae6b89eb3be749b5186b193ff53cabf3cbe70afebade5d567ce2cc60993edde1 URL.\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 08:30:17.257\t113\tAttempted to add URL (http://*:2869/upnp/eventing/) to URL group (0xFE00000820000001). Status: 0x0. Process Id 0x3DA0 Executable path \\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe, User S-1-5-19\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:30:17.291\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:17.404\t114\tRemoved URL (http://*:2869/upnp/eventing/) from URL group (0xFE00000820000001). Process Id 0x3DA0 Executable path \\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe, User S-1-5-19\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:30:17.432\t113\tAttempted to add URL (http://*:2869/upnp/eventing/) to URL group (0xFE00000720000001). Status: 0x0. Process Id 0x3DA0 Executable path \\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe, User S-1-5-19\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:30:17.436\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:17.576\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:17.721\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:17.840\t26\tWindows Update successfully found 0 updates.\tInformation\tMicrosoft-Windows-WindowsUpdateClient/Operational\tMicrosoft-Windows-WindowsUpdateClient\n05.09.2026 08:30:17.860\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:18.012\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:18.264\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:18.433\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:18.575\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:18.575\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:18.578\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:18.578\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:18.580\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:18.726\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:18.872\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:19.014\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:19.161\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:19.302\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:19.449\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:19.614\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:19.782\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:19.951\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:20.116\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:20.341\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:20.507\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:20.768\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:20.948\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:21.208\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:21.367\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:21.539\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:21.766\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:21.943\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:22.125\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:22.421\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:22.620\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:22.927\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:23.109\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:23.269\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:23.434\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:23.541\t8001\t\"Skipping license manager: PFN SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:23.543\t219\tPSMFlags for Desktop AppX process %1 with applicationID %2 is %3.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:30:23.609\t211\tAdded process 10436 to Desktop AppX container 245cdb95-a8c9-11f1-b7ff-289200f24a99 for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:30:23.611\t201\tCreated process 10436 for application SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_wyx1vj98g3asy!App in package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy. [FinishPackageActivation]\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:30:23.698\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:23.849\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:24.032\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:24.182\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:24.340\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:24.532\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:24.702\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:24.976\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:25.149\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:25.285\t217\tDestroyed Desktop AppX container {245CDB95-A8C9-11F1-B7FF-289200F24A99} for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:30:25.285\t8001\t\"Invoking license manager because license/lease polling time up: PFN SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (361)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:25.286\t8001\t\"ServicePackageRundownNotificationImpl PsmKey:SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy+App, sid:S-1-5-21-3712849175-2219398513-4278588552-1006\nFunction: ServicePackageRundownNotificationImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2587)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:25.286\t8011\t0x21f83176b80: 13668: 9CD2C66B-D3F2-3342-77A1-FDE6E819AC29: Dispatch: Key:Unregistered => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:25.286\t8001\t\"Lease dropped\nFunction: KeyMachine::DoDropLease\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (279)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:25.286\t8011\t0x21f8312ac20: 13728: {2779D781-9DB3-5818-8A8F-961408D4CA65}: Dispatch: Lease:RemoveKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:25.286\t8011\t0x21f8312ac20: 13728: {2779D781-9DB3-5818-8A8F-961408D4CA65}: Dispatch: Lease:Unregistered => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:25.286\t8012\t0x21f83176b80: 13668: Key:Valid Change: Key:Invalid => 9CD2C66B-D3F2-3342-77A1-FDE6E819AC29\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:25.286\t8012\t0x21f8312ac20: 13728: Lease:Valid Change: Lease:Invalid => {2779D781-9DB3-5818-8A8F-961408D4CA65}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:25.286\t8001\t\"Set results for lease = 0x0, policy = 0, operation = 0, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:25.286\t8001\t\"Requesting lease document removal for reason 0x00000000, {2779D781-9DB3-5818-8A8F-961408D4CA65}\nFunction: LicenseManagerCore::DoRemoveLeaseDocumentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (1460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:25.287\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2da9b29d-6370-e263-afcc-4c90e8d0d7d6\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=9cd2c66b-d3f2-3342-77a1-fde6e819ac29&entitlementId=2da9b29d-6370-e263-afcc-4c90e8d0d7d6&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"e6afc57e-e948-0700-1f5b-021330ec499e\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"9cd2c66b-d3f2-3342-77a1-fde6e819ac29\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9PCTGDFXVZLJ\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-07-07T01:54:10.2890432+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:25.287\t8001\t\"Ignoring lease removal with reason 0x00000000 because this is an offline lease\n\nFunction: ClipStorage::RemoveLeaseDocumentWithIdAndReason\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (501)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:25.287\t8002\t\"Trying to remove timer {2779D781-9DB3-5818-8A8F-961408D4CA65} not in table\nFunction: MemoryTimerService::CancelTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (80)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:25.287\t8001\t\"Removed timer for {2779D781-9DB3-5818-8A8F-961408D4CA65}\nFunction: MemoryTimerService::CleanupTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (19)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:25.418\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:25.584\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:25.741\t60\tBITS stopped transferring the Chrome Component Updater transfer job that is associated with the http://edgedl.me.gvt1.com/edgedl/diffgen-puffin/efniojlnjndmcbiieegkicadnoecjjef/ae6b89eb3be749b5186b193ff53cabf3cbe70afebade5d567ce2cc60993edde1 URL. The status code is 0x0.\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 08:30:25.748\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:25.910\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:26.174\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:26.345\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:26.613\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:26.769\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:26.925\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:27.083\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:27.257\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:27.353\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:27.354\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:27.354\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:27.360\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:27.431\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:27.594\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:27.758\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:27.915\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:28.086\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:28.253\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:28.367\t1005\tThe Connection Provider status changed to Disconnected.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:28.367\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:28.367\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:28.377\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:28.387\t1113\tDevice Compact Ticket request completed with Device Id 00180018E4F8342E for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:28.399\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:28.401\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:28.401\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:28.416\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:28.578\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:28.731\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:28.901\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:28.939\t4\t\"The transfer job is complete.\nUser: HONOR-FRG-X\\admin\nTransfer job: Chrome Component Updater\nJob ID: {df57cb3c-61e4-42c9-af52-ac0b58945dbd}\nOwner: HONOR-FRG-X\\admin\nFile count: 1\"\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 08:30:29.109\t3\t\"The BITS service created a new job.\nTransfer job: Chrome Component Updater\nJob ID: {36175a71-627d-4263-a8a6-33d45942d660}\nOwner: HONOR-FRG-X\\admin\nProcess Path: C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe\nProcess ID: 14724\"\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 08:30:29.115\t16403\t\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 08:30:29.158\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:29.221\t59\tBITS started the Chrome Component Updater transfer job that is associated with the http://edgedl.me.gvt1.com/edgedl/diffgen-puffin/hfnkpimlhhgieaddgfemjhofmfblmnib/2d5a57c27ad51b4804bdb8eb2e3358b685f3d3502788f352c1a0b9704e741b19 URL.\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 08:30:29.243\t114\tRemoved URL (http://*:2869/upnp/eventing/) from URL group (0xFE00000720000001). Process Id 0x3DA0 Executable path \\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe, User S-1-5-19\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:30:29.262\t113\tAttempted to add URL (http://*:2869/upnp/eventing/) to URL group (0xFE00000E20000001). Status: 0x0. Process Id 0x3DA0 Executable path \\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe, User S-1-5-19\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:30:29.316\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:29.333\t114\tRemoved URL (http://*:2869/upnp/eventing/) from URL group (0xFE00000E20000001). Process Id 0x3DA0 Executable path \\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe, User S-1-5-19\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:30:29.360\t113\tAttempted to add URL (http://*:2869/upnp/eventing/) to URL group (0xFA00000C20000001). Status: 0x0. Process Id 0x3DA0 Executable path \\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe, User S-1-5-19\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:30:29.512\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:29.678\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:29.850\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:30.010\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:30.167\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:30.218\t60\tBITS stopped transferring the Chrome Component Updater transfer job that is associated with the http://edgedl.me.gvt1.com/edgedl/diffgen-puffin/hfnkpimlhhgieaddgfemjhofmfblmnib/2d5a57c27ad51b4804bdb8eb2e3358b685f3d3502788f352c1a0b9704e741b19 URL. The status code is 0x0.\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 08:30:30.330\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:30.491\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:30.663\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:30.825\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:30.980\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:31.135\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:31.299\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:31.453\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:31.728\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:31.897\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:32.053\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:32.214\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:32.352\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, Win32_WIN32_TERMINALSERVICE_Prov, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:30:32.420\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:32.585\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:32.744\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:32.897\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:33.055\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:33.137\t4\t\"The transfer job is complete.\nUser: HONOR-FRG-X\\admin\nTransfer job: Chrome Component Updater\nJob ID: {36175a71-627d-4263-a8a6-33d45942d660}\nOwner: HONOR-FRG-X\\admin\nFile count: 1\"\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 08:30:33.224\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:33.262\t100\tDiagnostic module {c8544339-5be9-4f25-862e-485f1b1a6935} (%SystemRoot%\\system32\\diagperf.dll) detected a problem for scenario {86432a0b-3c7d-4ddf-a89c-172faa90485d}, instance {1282433c-4545-40de-ba0f-f72608f6da4b}, original activity ID {86432a0b-3c7d-4ddf-a89c-172faa90485d}.\tInformation\tMicrosoft-Windows-Diagnosis-DPS/Operational\tMicrosoft-Windows-Diagnosis-DPS\n05.09.2026 08:30:33.262\t105\tDiagnostic module {c8544339-5be9-4f25-862e-485f1b1a6935} (%SystemRoot%\\system32\\diagperf.dll) started troubleshooting scenario {86432a0b-3c7d-4ddf-a89c-172faa90485d}, instance {1282433c-4545-40de-ba0f-f72608f6da4b}, original activity ID {86432a0b-3c7d-4ddf-a89c-172faa90485d}.\tInformation\tMicrosoft-Windows-Diagnosis-DPS/Operational\tMicrosoft-Windows-Diagnosis-DPS\n05.09.2026 08:30:33.391\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:33.568\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:33.749\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:33.923\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:34.090\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:34.283\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:34.475\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:34.651\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:34.830\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:34.990\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:35.158\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:35.344\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:35.557\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:35.731\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:35.916\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:36.115\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:36.287\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:36.477\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:36.633\t100\t\"Windows has started up: \n     Boot Duration\t\t:\t33329ms\n     IsDegradation\t\t:\tfalse\n     Incident Time (UTC)\t:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:28:48.027125300Z\"\tWarning\tMicrosoft-Windows-Diagnostics-Performance/Operational\tMicrosoft-Windows-Diagnostics-Performance\n05.09.2026 08:30:36.633\t101\t\"This application took longer than usual to start up, resulting in a performance degradation in the system startup process: \n     File Name\t\t:\tMsMpEng.exe\n     Friendly Name\t\t:\tAntimalware Service Executable\n     Version\t\t:\t4.18.26080.3 (9e1f3147fbc83f18a98a965394a23e07747d7295)\n     Total Time\t\t:\t6992ms\n     Degradation Time\t:\t1992ms\n     Incident Time (UTC)\t:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:28:48.027125300Z\"\tWarning\tMicrosoft-Windows-Diagnostics-Performance/Operational\tMicrosoft-Windows-Diagnostics-Performance\n05.09.2026 08:30:36.633\t101\t\"This application took longer than usual to start up, resulting in a performance degradation in the system startup process: \n     File Name\t\t:\tmsedgewebview2.exe\n     Friendly Name\t\t:\tMicrosoft Edge WebView2\n     Version\t\t:\t152.0.4191.62\n     Total Time\t\t:\t2717ms\n     Degradation Time\t:\t217ms\n     Incident Time (UTC)\t:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:28:48.027125300Z\"\tWarning\tMicrosoft-Windows-Diagnostics-Performance/Operational\tMicrosoft-Windows-Diagnostics-Performance\n05.09.2026 08:30:36.653\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:36.729\t110\tDiagnostic module {c8544339-5be9-4f25-862e-485f1b1a6935} (%SystemRoot%\\system32\\diagperf.dll) finished troubleshooting scenario {86432a0b-3c7d-4ddf-a89c-172faa90485d}, instance {1282433c-4545-40de-ba0f-f72608f6da4b}, original activity ID {86432a0b-3c7d-4ddf-a89c-172faa90485d}.  No resolution was set by the diagnostic module.\tInformation\tMicrosoft-Windows-Diagnosis-DPS/Operational\tMicrosoft-Windows-Diagnosis-DPS\n05.09.2026 08:30:36.920\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:37.081\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:37.184\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:37.184\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:37.190\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:37.190\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:37.238\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:37.407\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:37.588\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:37.749\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:37.916\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:38.184\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:38.367\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:38.634\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:38.794\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:38.944\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:39.102\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:39.265\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:39.432\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:39.590\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:39.747\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:39.908\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:40.068\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:40.220\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:40.393\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:40.559\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:40.723\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:40.882\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:41.039\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:41.200\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:41.355\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:41.524\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:41.693\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:41.870\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:42.040\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:42.189\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:42.446\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:42.605\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:42.768\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:42.933\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:43.091\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:43.258\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:43.415\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:43.571\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:43.747\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:43.909\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:44.101\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:44.263\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:44.426\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:44.584\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:44.753\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:44.913\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:45.088\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:45.243\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:45.507\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:45.670\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:45.828\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:45.967\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:45.967\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:45.967\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:45.973\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:45.991\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:46.150\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:46.304\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:46.479\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:46.644\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:46.808\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:46.964\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:47.121\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:47.289\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:47.451\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:47.721\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:47.923\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:48.090\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:48.243\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:48.407\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:48.567\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:48.727\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:48.885\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:49.046\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:49.208\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:49.305\t42\tWHEA event log entry\tInformation\tMicrosoft-Windows-Kernel-WHEA/Operational\tMicrosoft-Windows-Kernel-WHEA\n05.09.2026 08:30:49.371\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:49.638\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:49.790\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:49.948\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:50.139\t30810\t\"Added a TCP/IP transport interface.\n\nName: \u041f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435 \u043f\u043e \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u0439 \u0441\u0435\u0442\u0438* 10\nInterfaceIndex: 0xA\n\nGuidance:\nA TCP/IP binding was added to the specified network adapter for the SMB client. The SMB client can now send and receive SMB traffic on this network adapter using TCP/IP. You should expect this event when a computer restarts or when a previously disabled network adaptor is re-enabled. No user action is required.\"\tInformation\tMicrosoft-Windows-SmbClient/Connectivity\tMicrosoft-Windows-SMBClient\n05.09.2026 08:30:50.139\t1040\tReceived Mib notification type MibAddInstance for interface 10\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:30:50.139\t1034\tSend RDMA Endpoint notification failure - DadState is different from IpDadStatePreferred for interface 10. Current DadState: 3.\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:30:50.178\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:30:50.178\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:30:50.219\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:50.371\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:50.534\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:50.640\t4004\t\"Network State Change Fired\n\tNew Internet Connection Profile: false\n\tConnection Cost Changed: false\n\tDomain Connectivity Level Changed: false\n\tNetwork Connectivity Level Changed: false\n\tHost Name Changed: true\n\tWwan Registration State Changed: false\n\tTethering Operational State Changed: false\n\tTethering Client Count Changed: false\"\tInformation\tMicrosoft-Windows-NetworkProfile/Operational\tMicrosoft-Windows-NetworkProfile\n05.09.2026 08:30:50.650\t1024\tInternet connection status changed to true, submitting pending workitems: count = 0.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:50.699\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:50.965\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:51.134\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:51.303\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:51.463\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:51.627\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:51.783\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:51.946\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:52.202\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:52.368\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:52.549\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:52.708\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:52.870\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:53.028\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:53.185\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:53.348\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:53.514\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:53.675\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:53.826\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:53.992\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:54.150\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:54.320\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:54.484\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:54.657\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:54.821\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:54.991\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:55.148\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:55.415\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:55.587\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:55.745\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:55.914\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:56.074\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:56.229\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:56.319\t30810\t\"Added a TCP/IP transport interface.\n\nName: \u041f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435 \u043f\u043e \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u0439 \u0441\u0435\u0442\u0438* 10\nInterfaceIndex: 0xA\n\nGuidance:\nA TCP/IP binding was added to the specified network adapter for the SMB client. The SMB client can now send and receive SMB traffic on this network adapter using TCP/IP. You should expect this event when a computer restarts or when a previously disabled network adaptor is re-enabled. No user action is required.\"\tInformation\tMicrosoft-Windows-SmbClient/Connectivity\tMicrosoft-Windows-SMBClient\n05.09.2026 08:30:56.319\t1040\tReceived Mib notification type MibAddInstance for interface 10\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:30:56.319\t1034\tSend RDMA Endpoint notification failure - DadState is different from IpDadStatePreferred for interface 10. Current DadState: 1.\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:30:56.405\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:56.573\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:56.865\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:57.035\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:57.297\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:57.457\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:57.615\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:57.782\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:57.948\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:58.115\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:58.140\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:58.144\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:58.144\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:58.279\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:58.428\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:58.589\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:58.750\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:58.940\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:59.207\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:59.370\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:59.540\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:59.701\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:59.857\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:00.026\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:00.179\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:00.354\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:00.519\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:00.685\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:00.953\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:01.108\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:01.274\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:01.328\t4004\t\"Network State Change Fired\n\tNew Internet Connection Profile: false\n\tConnection Cost Changed: false\n\tDomain Connectivity Level Changed: false\n\tNetwork Connectivity Level Changed: false\n\tHost Name Changed: true\n\tWwan Registration State Changed: false\n\tTethering Operational State Changed: false\n\tTethering Client Count Changed: false\"\tInformation\tMicrosoft-Windows-NetworkProfile/Operational\tMicrosoft-Windows-NetworkProfile\n05.09.2026 08:31:01.338\t1024\tInternet connection status changed to true, submitting pending workitems: count = 0.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:01.435\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:01.486\t0\tService stopped.\tInformation\tApplication\tedgeupdate\n05.09.2026 08:31:01.706\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:01.973\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:02.128\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:02.285\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:02.449\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:02.624\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:02.798\t900\t\"The Software Protection service is starting.\nParameters:\"\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 08:31:02.847\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:02.859\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\t{48A1CEBF-3174-4FFD-BA33-4EFACDCDBCCC}\n\tRule Name:\tTrustCircleService\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:02.860\t16394\tOffline downlevel migration succeeded.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 08:31:02.864\t2099\t\"A rule has been modified in the Windows Defender Firewall exception list.\n\nModified Rule:\n\tRule ID:\t{DF062EC5-5CFA-4F0B-AC28-423B1669F4E1}\n\tRule Name:\tTrustCircleService\n\tOrigin:\t0\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPrivate,Domain, Public\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\HONOR\\TrustCircle\\HnTrustCircleService.exe\n\tService Name:\t\n\tProtocol:\tAny\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t2\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:02.865\t2097\t\"A rule has been added to the Windows Defender Firewall exception list.\n\nAdded Rule:\n\tRule ID:\t{DF062EC5-5CFA-4F0B-AC28-423B1669F4E1}\n\tRule Name:\tTrustCircleService\n\tOrigin:\tLocal\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPrivate,Domain, Public\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\HONOR\\TrustCircle\\HnTrustCircleService.exe\n\tService Name:\t\n\tProtocol:\tAny\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:02.931\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:31:02.931\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:31:03.050\t17\tThe Trusted Platform Module (TPM) hardware failed to execute a TPM command.\tInformation\tSystem\tTPM\n05.09.2026 08:31:03.074\t17\tThe Trusted Platform Module (TPM) hardware failed to execute a TPM command.\tInformation\tSystem\tTPM\n05.09.2026 08:31:03.076\t17\tThe Trusted Platform Module (TPM) hardware failed to execute a TPM command.\tInformation\tSystem\tTPM\n05.09.2026 08:31:03.108\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:03.193\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:31:03.193\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:31:03.268\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:03.331\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:31:03.331\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:31:03.440\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:03.606\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:03.725\t1\tThe Windows Security Center Service has started.\tInformation\tApplication\tSecurityCenter\n05.09.2026 08:31:03.773\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:03.937\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:04.223\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"23528CA76A0\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:04.233\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"ControlCenterTrayUI\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:04.262\t1002\tError 0x80070005 occurred while verifying known folder {5e6c858f-0e22-4760-9afe-ea3317b67173} with path 'C:\\Users\\admin'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:31:05.752\t15\tUpdated Windows Defender status successfully to SECURITY_PRODUCT_STATE_ON.\tInformation\tApplication\tSecurityCenter\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.612\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\t{9BE5B4C9-88D0-43BB-BC6A-904308D6DF22}\n\tRule Name:\tHNMIRROR\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:06.655\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\t{942D4F0B-D6EB-4B6A-BA8E-968479740A23}\n\tRule Name:\tHNMIRROR\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:06.699\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\t{1B29CA73-70F2-4888-B1FF-5529A3CBA825}\n\tRule Name:\tHNMIRROR\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:06.778\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\t{6BD78914-57CC-4AE2-8256-2A8241F304A3}\n\tRule Name:\tDISTRIBUTEDFILESERVICE\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:06.825\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\t{395F0B8D-70D9-48F7-BF61-CA026A296CF8}\n\tRule Name:\tDISTRIBUTEDFILESERVICE\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:06.880\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\t{7922CEA8-4B6E-498F-8FF3-C5C6D55A6412}\n\tRule Name:\tDISTRIBUTEDFILESERVICE\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:06.927\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:06.927\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:06.929\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:06.929\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:06.949\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\t{25561356-BD40-494A-A14B-E9E40181373B}\n\tRule Name:\tHNVIRTUALPERIPHERAL\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.013\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\t{BCAC134D-07A7-4CF4-9104-663EF3AEC81C}\n\tRule Name:\tHNEXSCREEN\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.060\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\t{1C1019A7-5DDE-451F-A029-A50D19003CA7}\n\tRule Name:\tHNEXSCREEN\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.105\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\t{F0C0049F-D309-4878-AFE0-F72A7C7C7C9B}\n\tRule Name:\tHNEXSCREEN\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.282\t2099\t\"A rule has been modified in the Windows Defender Firewall exception list.\n\nModified Rule:\n\tRule ID:\t{0199F236-FADA-4802-BE23-FEAFB1D6B2C3}\n\tRule Name:\tHNMIRROR\n\tOrigin:\t0\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPublic\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\Honor\\TrustCircle\\HnMirror.exe\n\tService Name:\t\n\tProtocol:\tTCP\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t2\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.286\t2097\t\"A rule has been added to the Windows Defender Firewall exception list.\n\nAdded Rule:\n\tRule ID:\t{0199F236-FADA-4802-BE23-FEAFB1D6B2C3}\n\tRule Name:\tHNMIRROR\n\tOrigin:\tLocal\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPublic\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\Honor\\TrustCircle\\HnMirror.exe\n\tService Name:\t\n\tProtocol:\tTCP\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.288\t2099\t\"A rule has been modified in the Windows Defender Firewall exception list.\n\nModified Rule:\n\tRule ID:\t{68EE77E1-425B-4613-A88B-C905CB4913E5}\n\tRule Name:\tHNMIRROR\n\tOrigin:\t0\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPublic\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\Honor\\TrustCircle\\HnMirror.exe\n\tService Name:\t\n\tProtocol:\tUDP\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t2\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.290\t2097\t\"A rule has been added to the Windows Defender Firewall exception list.\n\nAdded Rule:\n\tRule ID:\t{68EE77E1-425B-4613-A88B-C905CB4913E5}\n\tRule Name:\tHNMIRROR\n\tOrigin:\tLocal\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPublic\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\Honor\\TrustCircle\\HnMirror.exe\n\tService Name:\t\n\tProtocol:\tUDP\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.296\t2099\t\"A rule has been modified in the Windows Defender Firewall exception list.\n\nModified Rule:\n\tRule ID:\t{B9FA39D4-DA07-49C3-9D05-81366D8565EB}\n\tRule Name:\tHNMIRROR\n\tOrigin:\t0\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPrivate,Domain, Public\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\HONOR\\TrustCircle\\HnMirror.exe\n\tService Name:\t\n\tProtocol:\tAny\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t2\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.300\t2097\t\"A rule has been added to the Windows Defender Firewall exception list.\n\nAdded Rule:\n\tRule ID:\t{B9FA39D4-DA07-49C3-9D05-81366D8565EB}\n\tRule Name:\tHNMIRROR\n\tOrigin:\tLocal\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPrivate,Domain, Public\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\HONOR\\TrustCircle\\HnMirror.exe\n\tService Name:\t\n\tProtocol:\tAny\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.445\t2099\t\"A rule has been modified in the Windows Defender Firewall exception list.\n\nModified Rule:\n\tRule ID:\t{1519AAE9-7ADA-467A-8630-79672866C5F8}\n\tRule Name:\tDISTRIBUTEDFILESERVICE\n\tOrigin:\t0\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPublic\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\Honor\\TrustCircle\\distributedfileservice.exe\n\tService Name:\t\n\tProtocol:\tTCP\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t2\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.448\t2097\t\"A rule has been added to the Windows Defender Firewall exception list.\n\nAdded Rule:\n\tRule ID:\t{1519AAE9-7ADA-467A-8630-79672866C5F8}\n\tRule Name:\tDISTRIBUTEDFILESERVICE\n\tOrigin:\tLocal\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPublic\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\Honor\\TrustCircle\\distributedfileservice.exe\n\tService Name:\t\n\tProtocol:\tTCP\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.452\t2099\t\"A rule has been modified in the Windows Defender Firewall exception list.\n\nModified Rule:\n\tRule ID:\t{D8EC5264-8722-4C51-B12B-32617B645411}\n\tRule Name:\tDISTRIBUTEDFILESERVICE\n\tOrigin:\t0\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPublic\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\Honor\\TrustCircle\\distributedfileservice.exe\n\tService Name:\t\n\tProtocol:\tUDP\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t2\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.454\t2097\t\"A rule has been added to the Windows Defender Firewall exception list.\n\nAdded Rule:\n\tRule ID:\t{D8EC5264-8722-4C51-B12B-32617B645411}\n\tRule Name:\tDISTRIBUTEDFILESERVICE\n\tOrigin:\tLocal\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPublic\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\Honor\\TrustCircle\\distributedfileservice.exe\n\tService Name:\t\n\tProtocol:\tUDP\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.461\t2099\t\"A rule has been modified in the Windows Defender Firewall exception list.\n\nModified Rule:\n\tRule ID:\t{5B70920B-660F-4DFE-B2A0-6341133B5D76}\n\tRule Name:\tDISTRIBUTEDFILESERVICE\n\tOrigin:\t0\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPrivate,Domain, Public\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\HONOR\\TrustCircle\\distributedfileservice.exe\n\tService Name:\t\n\tProtocol:\tAny\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t2\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.464\t2097\t\"A rule has been added to the Windows Defender Firewall exception list.\n\nAdded Rule:\n\tRule ID:\t{5B70920B-660F-4DFE-B2A0-6341133B5D76}\n\tRule Name:\tDISTRIBUTEDFILESERVICE\n\tOrigin:\tLocal\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPrivate,Domain, Public\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\HONOR\\TrustCircle\\distributedfileservice.exe\n\tService Name:\t\n\tProtocol:\tAny\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.525\t2099\t\"A rule has been modified in the Windows Defender Firewall exception list.\n\nModified Rule:\n\tRule ID:\t{03AA7394-D320-4E85-B2DC-8744EB6A680B}\n\tRule Name:\tHNVIRTUALPERIPHERAL\n\tOrigin:\t0\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPrivate,Domain, Public\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\HONOR\\TrustCircle\\HnVirtualPeripheral.exe\n\tService Name:\t\n\tProtocol:\tAny\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t2\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.528\t2097\t\"A rule has been added to the Windows Defender Firewall exception list.\n\nAdded Rule:\n\tRule ID:\t{03AA7394-D320-4E85-B2DC-8744EB6A680B}\n\tRule Name:\tHNVIRTUALPERIPHERAL\n\tOrigin:\tLocal\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPrivate,Domain, Public\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\HONOR\\TrustCircle\\HnVirtualPeripheral.exe\n\tService Name:\t\n\tProtocol:\tAny\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.684\t2099\t\"A rule has been modified in the Windows Defender Firewall exception list.\n\nModified Rule:\n\tRule ID:\t{43E68C43-E8D1-4C09-864D-7E0F9CCC962C}\n\tRule Name:\tHNEXSCREEN\n\tOrigin:\t0\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPublic\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\Honor\\TrustCircle\\HnExScreen.exe\n\tService Name:\t\n\tProtocol:\tTCP\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t2\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.687\t2097\t\"A rule has been added to the Windows Defender Firewall exception list.\n\nAdded Rule:\n\tRule ID:\t{43E68C43-E8D1-4C09-864D-7E0F9CCC962C}\n\tRule Name:\tHNEXSCREEN\n\tOrigin:\tLocal\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPublic\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\Honor\\TrustCircle\\HnExScreen.exe\n\tService Name:\t\n\tProtocol:\tTCP\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.690\t2099\t\"A rule has been modified in the Windows Defender Firewall exception list.\n\nModified Rule:\n\tRule ID:\t{B07A023E-B5BE-4B28-B4B8-8D0C49BC00EA}\n\tRule Name:\tHNEXSCREEN\n\tOrigin:\t0\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPublic\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\Honor\\TrustCircle\\HnExScreen.exe\n\tService Name:\t\n\tProtocol:\tUDP\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t2\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.692\t2097\t\"A rule has been added to the Windows Defender Firewall exception list.\n\nAdded Rule:\n\tRule ID:\t{B07A023E-B5BE-4B28-B4B8-8D0C49BC00EA}\n\tRule Name:\tHNEXSCREEN\n\tOrigin:\tLocal\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPublic\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\Honor\\TrustCircle\\HnExScreen.exe\n\tService Name:\t\n\tProtocol:\tUDP\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.702\t2099\t\"A rule has been modified in the Windows Defender Firewall exception list.\n\nModified Rule:\n\tRule ID:\t{0B0162F8-B4FF-4EA4-B34B-3D20774B1359}\n\tRule Name:\tHNEXSCREEN\n\tOrigin:\t0\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPrivate,Domain, Public\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\HONOR\\TrustCircle\\HnExScreen.exe\n\tService Name:\t\n\tProtocol:\tAny\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t2\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.705\t2097\t\"A rule has been added to the Windows Defender Firewall exception list.\n\nAdded Rule:\n\tRule ID:\t{0B0162F8-B4FF-4EA4-B34B-3D20774B1359}\n\tRule Name:\tHNEXSCREEN\n\tOrigin:\tLocal\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPrivate,Domain, Public\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\HONOR\\TrustCircle\\HnExScreen.exe\n\tService Name:\t\n\tProtocol:\tAny\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.801\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\t{844036A5-D395-47A0-BFA8-252D279FD75C}\n\tRule Name:\tHNVCR\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.830\t2099\t\"A rule has been modified in the Windows Defender Firewall exception list.\n\nModified Rule:\n\tRule ID:\t{77457934-994E-4619-8481-5A562AAFB199}\n\tRule Name:\tHNVCR\n\tOrigin:\t0\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPrivate,Domain, Public\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\HONOR\\TrustCircle\\HNVCR.exe\n\tService Name:\t\n\tProtocol:\tTCP\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t2\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.833\t2097\t\"A rule has been added to the Windows Defender Firewall exception list.\n\nAdded Rule:\n\tRule ID:\t{77457934-994E-4619-8481-5A562AAFB199}\n\tRule Name:\tHNVCR\n\tOrigin:\tLocal\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPrivate,Domain, Public\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\HONOR\\TrustCircle\\HNVCR.exe\n\tService Name:\t\n\tProtocol:\tTCP\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.952\t5058\t\"Key file operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nProcess Information:\n\tProcess ID:\t\t2948\n\tProcess Creation Time:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:31:02.375569800Z\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tUNKNOWN\n\tKey Name:\tB27EAB5EBD405C968CD635ABFB18512102735CA868E2034C962198471AE8987F\n\tKey Type:\tUser key.\n\nKey File Operation Information:\n\tFile Path:\tC:\\ProgramData\\Microsoft\\Crypto\\SystemKeys\\7850c5a22ed35c8d4f5f84e1175f284f_aae0f96c-9dfa-4728-bee3-a8368e406b6b\n\tOperation:\tRead persisted key from file.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:31:07.953\t5061\t\"Cryptographic operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tECDH_P256\n\tKey Name:\tB27EAB5EBD405C968CD635ABFB18512102735CA868E2034C962198471AE8987F\n\tKey Type:\tUser key.\n\nCryptographic Operation:\n\tOperation:\tOpen Key.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:31:09.776\t8011\t0x21f83178e90: 13668: EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED: Dispatch: Key:Unregistered => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:09.776\t8001\t\"Lease dropped\nFunction: KeyMachine::DoDropLease\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (279)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:09.776\t8012\t0x21f83178e90: 13668: Key:Valid Change: Key:Invalid => EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:09.776\t8001\t\"Set results for lease = 0x0, policy = 0, operation = 0, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:09.776\t8011\t0x21f8312aa20: 13728: {7BA318A1-DC47-F731-723C-537E883DC563}: Dispatch: Lease:RemoveKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:09.777\t8011\t0x21f8312aa20: 13728: {7BA318A1-DC47-F731-723C-537E883DC563}: Dispatch: Lease:Unregistered => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:09.777\t8012\t0x21f8312aa20: 13728: Lease:Valid Change: Lease:Invalid => {7BA318A1-DC47-F731-723C-537E883DC563}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:09.777\t8001\t\"Requesting lease document removal for reason 0x00000000, {7BA318A1-DC47-F731-723C-537E883DC563}\nFunction: LicenseManagerCore::DoRemoveLeaseDocumentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (1460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:09.780\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"200dc622-8cbd-e337-4d4b-69d2fa6e7df7\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966575679381420&contentId=eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed&entitlementId=200dc622-8cbd-e337-4d4b-69d2fa6e7df7&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"0f8e2cd5-b8eb-7a22-b9e9-9b1183fa0a84\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NMPJ99VJBWV\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-08-04T14:54:13.8630559+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:09.780\t8001\t\"Ignoring lease removal with reason 0x00000000 because this is an offline lease\n\nFunction: ClipStorage::RemoveLeaseDocumentWithIdAndReason\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (501)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:09.781\t8002\t\"Trying to remove timer {7BA318A1-DC47-F731-723C-537E883DC563} not in table\nFunction: MemoryTimerService::CancelTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (80)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:09.781\t8001\t\"Removed timer for {7BA318A1-DC47-F731-723C-537E883DC563}\nFunction: MemoryTimerService::CleanupTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (19)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:11.107\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"23528CA76A0\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:11.112\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:11.329\t8001\t\"Invoking license manager because license/lease polling time up: PFN A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (361)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:11.330\t8001\t\"ServicePackageRundownNotificationImpl PsmKey:A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6+App, sid:S-1-5-21-3712849175-2219398513-4278588552-1006\nFunction: ServicePackageRundownNotificationImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2587)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:11.330\t8011\t0x21f831d39d0: 13668: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A: Dispatch: Key:Unregistered => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:11.330\t8001\t\"Lease dropped\nFunction: KeyMachine::DoDropLease\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (279)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:11.330\t8012\t0x21f831d39d0: 13668: Key:Valid Change: Key:Invalid => 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:11.330\t8001\t\"Set results for lease = 0x0, policy = 0, operation = 0, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:11.330\t8011\t0x21f8312b620: 13668: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}: Dispatch: Lease:RemoveKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:11.330\t8011\t0x21f8312b620: 13668: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}: Dispatch: Lease:Unregistered => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:11.330\t8012\t0x21f8312b620: 13668: Lease:Valid Change: Lease:Invalid => {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:11.330\t8001\t\"Requesting lease document removal for reason 0x00000000, {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\nFunction: LicenseManagerCore::DoRemoveLeaseDocumentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (1460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:11.332\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2be1da80-9d39-1a56-8b4b-dca10f958cc2\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=80daf1f6-7afc-6d23-2c3c-f1e0a663029a&entitlementId=2be1da80-9d39-1a56-8b4b-dca10f958cc2&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"de7849ea-b8e4-60d1-c780-7b0969a99e76\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"80daf1f6-7afc-6d23-2c3c-f1e0a663029a\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NBLGGH0CB6D\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-09-04T15:27:12.2174791+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:11.332\t8001\t\"Ignoring lease removal with reason 0x00000000 because this is an offline lease\n\nFunction: ClipStorage::RemoveLeaseDocumentWithIdAndReason\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (501)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:11.333\t8002\t\"Trying to remove timer {1173A7B1-89F2-09CC-0563-CDED7D7397B9} not in table\nFunction: MemoryTimerService::CancelTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (80)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:11.333\t8001\t\"Removed timer for {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\nFunction: MemoryTimerService::CleanupTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (19)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:11.920\t1005\tThe Connection Provider status changed to Disconnected.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:11.920\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:11.920\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:11.935\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:11.944\t1113\tDevice Compact Ticket request completed with Device Id 00180018E4F8342E for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:11.945\t1205\tWNP Transport Layer Disconnect call initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:13.020\t8001\t\"Skipping license manager: PFN Microsoft.WindowsFeedbackHub_2.2606.702.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:13.646\t217\tDestroyed Desktop AppX container {245CDC17-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.DesktopAppInstaller_1.29.290.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:31:29.444\t1005\tThe Connection Provider status changed to Disconnected.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:29.444\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:29.444\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:29.457\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:29.471\t1113\tDevice Compact Ticket request completed with Device Id 00180018E4F8342E for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:29.483\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:29.490\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:29.490\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:32.920\t16384\tSuccessfully scheduled Software Protection service for re-start at 2126-08-12T01:31:32Z. Reason: RulesEngine.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 08:31:38.053\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:31:38.053\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:31:38.173\t6\tFrameServer FsProxy Initialization Start, SymbolicLink: \\\\?\\usb#vid_5858&pid_1004&mi_00#6&55f168&0&0000#{65e8773d-8f56-11d0-a3b9-00a0c9223196}\\global, Devices: 1, StreamType: MASTER.\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:31:38.190\t11\t\"FrameServer WatchdogTimer Start Event, TimerScope: FSSource, TimerScopeId: 0, WatchdogOperation: Initialize, DurationToTriggerInHns: 300000000, \nSymbolicLink: \\\\?\\USB#VID_5858&PID_1004&MI_00#6&55f168&0&0000#{e5323777-f976-4f5b-9b55-b94699c46e44}\\global.\"\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:31:38.190\t200\tStart of PowerUpDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:31:38.190\t201\tStop of PowerUpDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:31:38.190\t217\tFilterIrp Pending\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:31:38.252\t204\tStart of StartUSBVideoDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:31:38.252\t205\tStop of StartUSBVideoDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:31:38.252\t215\tStart of PowerIrpCompletion\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:31:38.252\t220\tPowerIrp_CheckingPLFRegistry\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:31:38.252\t216\tStop of PowerIrpCompletion\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:31:38.253\t218\tFilterIrp Completed\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:31:38.253\t218\tFilterIrp Completed\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:31:38.253\t230\tPowerIrp_PassiveWakeupCompleted\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:31:38.255\t12\tFrameServer WatchdogTimer Stop Event, TimerScope: FSSource, TimerScopeId: 0, WatchdogOperation: Initialize, DurationToCompletionInHns: 645183.\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:31:38.255\t50\tCamera DeviceMFT InitializeTransform, SymbolicLink: \\\\?\\USB#VID_5858&PID_1004&MI_00#6&55f168&0&0000#{e5323777-f976-4f5b-9b55-b94699c46e44}\\global\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_DeviceMFT\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:31:38.256\t11\t\"FrameServer WatchdogTimer Start Event, TimerScope: FSSource, TimerScopeId: 0, WatchdogOperation: Initialize, DurationToTriggerInHns: 299354649, \nSymbolicLink: \\\\?\\USB#VID_5858&PID_1004&MI_00#6&55f168&0&0000#{e5323777-f976-4f5b-9b55-b94699c46e44}\\global.\"\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:31:38.256\t12\tFrameServer WatchdogTimer Stop Event, TimerScope: FSSource, TimerScopeId: 0, WatchdogOperation: Initialize, DurationToCompletionInHns: 6201.\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:31:38.256\t11\t\"FrameServer WatchdogTimer Start Event, TimerScope: FSSource, TimerScopeId: 0, WatchdogOperation: Initialize, DurationToTriggerInHns: 299348375, \nSymbolicLink: \\\\?\\USB#VID_5858&PID_1004&MI_00#6&55f168&0&0000#{e5323777-f976-4f5b-9b55-b94699c46e44}\\global.\"\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:31:38.256\t12\tFrameServer WatchdogTimer Stop Event, TimerScope: FSSource, TimerScopeId: 0, WatchdogOperation: Initialize, DurationToCompletionInHns: 1817.\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:31:38.256\t51\tCamera DeviceMFT InitializeTransform, hr: 0x0\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_DeviceMFT\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:31:38.268\t22\tFrameServer_FSSourceMediaSource_SetWorkQueue Event, StreamObject: 0x18b6c1c5d60, WorkQueueId: 327681, Priority: 0, MediaStreamCount: 1.\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:31:38.268\t20\tFrameServer_FSSourceMediaStream_SetWorkQueue Event, StreamObject: 0x18b6c177950, WorkQueueId: 327681, Priority: 0.\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:31:38.272\t7\tFrameServer FsProxy Initialization Stop, SymbolicLink: \\\\?\\usb#vid_5858&pid_1004&mi_00#6&55f168&0&0000#{65e8773d-8f56-11d0-a3b9-00a0c9223196}\\global, Devices: 1, Streams: 1, StreamType: MASTER, hr: 0x0.\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:31:38.273\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:38.273\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:38.275\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:38.275\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:38.287\t2\tFrameServer FsProxy SetOutputType Start, PinId: 0, MediaType: FrameSize=5497558139600 (1280,720),MajorType={73646976-0000-0010-8000-00AA00389B71},FrameRate=128849018881 (30,1),PixelAspectRatio=4294967297 (1,1),InterlacedMode=2,Subtype={3231564E-0000-0010-8000-00AA00389B71}.\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:31:38.287\t3\tFrameServer FsProxy SetOutputType Stop, hr=0x0.\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:31:38.306\t200\tStart of PowerUpDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:31:38.306\t201\tStop of PowerUpDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:31:47.047\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:47.047\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:47.047\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:47.054\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:57.332\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:57.347\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:57.347\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:06.129\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:06.129\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:06.137\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:06.137\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:14.906\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:14.906\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:14.906\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:14.917\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:16.594\t1002\tError 0x80070005 occurred while verifying known folder {a520a1a4-1780-4ff6-bd18-167343c5af16} with path 'C:\\Users\\admin\\AppData\\Local\\Packages\\cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104\\AC'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:32:21.002\t1\tAccess to the a resource has been denied for a less privileged app container at \u200e2026\u200e-\u200e09\u200e-\u200e05T01:32:21.002306800Z (StackHash: 0xF4411927).\tError\tMicrosoft-Windows-Security-LessPrivilegedAppContainer/Operational\tMicrosoft-Windows-Security-LessPrivilegedAppContainer\n05.09.2026 08:32:21.002\t1\tAccess to the a resource has been denied for a less privileged app container at \u200e2026\u200e-\u200e09\u200e-\u200e05T01:32:21.002765700Z (StackHash: 0xF4411927).\tError\tMicrosoft-Windows-Security-LessPrivilegedAppContainer/Operational\tMicrosoft-Windows-Security-LessPrivilegedAppContainer\n05.09.2026 08:32:21.943\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"23528CA76A0\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:32:21.953\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:32:22.338\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"23528CA76A0\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:32:22.341\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:32:32.772\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:32.775\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:32.775\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:33.141\t7040\tThe start type of the \u0424\u043e\u043d\u043e\u0432\u0430\u044f \u0438\u043d\u0442\u0435\u043b\u043b\u0435\u043a\u0442\u0443\u0430\u043b\u044c\u043d\u0430\u044f \u0441\u043b\u0443\u0436\u0431\u0430 \u043f\u0435\u0440\u0435\u0434\u0430\u0447\u0438 (BITS) service was changed from \u0410\u0432\u0442\u043e\u043c\u0430\u0442\u0438\u0447\u0435\u0441\u043a\u0438 to \u0412\u0440\u0443\u0447\u043d\u0443\u044e.\tInformation\tSystem\tService Control Manager\n05.09.2026 08:32:33.157\t114\tRemoved URL (http://*:2869/upnp/eventing/) from URL group (0xFA00000C20000001). Process Id 0x3DA0 Executable path \\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe, User S-1-5-19\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:32:38.751\t1010\t\"Device USB\\VID_22D9&PID_2769\\3B15AW01DRA00000 has been surprise removed as it is reported as missing on the bus.\nCount of devices removed: 1\"\tInformation\tMicrosoft-Windows-Kernel-PnP/Device Management\tMicrosoft-Windows-Kernel-PnP\n05.09.2026 08:32:39.357\t1001\tDevice will enter the suspend state if idle for 30 seconds.\tInformation\tMicrosoft-Windows-WPD-MTPClassDriver/Operational\tMicrosoft-Windows-WPD-MTPClassDriver\n05.09.2026 08:32:39.373\t1000\tMTP Driver started successfully.\tInformation\tMicrosoft-Windows-WPD-MTPClassDriver/Operational\tMicrosoft-Windows-WPD-MTPClassDriver\n05.09.2026 08:32:39.373\t1003\tDevice is resuming operation from idle state (Idle state: 4; Return code: 0x0).\tInformation\tMicrosoft-Windows-WPD-MTPClassDriver/Operational\tMicrosoft-Windows-WPD-MTPClassDriver\n05.09.2026 08:32:39.376\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:32:39.377\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:32:40.377\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"23528CA76A0\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:32:40.381\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"explorer\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:32:41.543\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:41.543\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:41.629\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:41.629\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:50.399\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:50.399\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:50.399\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:50.405\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:57.359\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"23528CA76A0\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:32:57.364\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:32:59.000\t1005\tThe Connection Provider status changed to Disconnected.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:59.000\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:59.000\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:59.007\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:59.013\t1113\tDevice Compact Ticket request completed with Device Id 00180018E4F8342E for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:59.025\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:59.026\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:59.026\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:59.026\t8001\t\"Skipping license manager: PFN Microsoft.WindowsFeedbackHub_2.2606.702.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:32:59.027\t8001\t\"Skipping license manager: PFN Microsoft.WindowsFeedbackHub_2.2606.702.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:33:03.739\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:33:03.739\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:33:03.910\t2416\tA local notification was received from Windows.Defender.SecurityCenter [AppUserModelId] with a 0 [NotificationId] through an application endpoint.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:03.912\t2418\tA local notification was submitted to threadpool: Windows.Defender.SecurityCenter [AppUserModelId] toast [NotificationType] 9397 [NotificationTrackingId] Local [NotificationSource].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:03.913\t3052\tToast with notification tracking id 9397 is being delivered to Windows.Defender.SecurityCenter on session 1.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:03.913\t3153\tToast with notification tracking id 9397 is delivered to Windows.Defender.SecurityCenter on session 1.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:03.916\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:04.207\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:05.145\t24\t\"Stream started.\nApp Id: Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy!App\nPID: 13180\nAudio Stream Category: 5\"\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 08:33:06.481\t25\t\"Stream stopped.\nApp Id: Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy!App\nPID: 13180\nAudio Stream Category: 5\"\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 08:33:07.794\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:07.794\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:07.795\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:07.795\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:16.566\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:16.566\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:16.566\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:16.575\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:34.144\t171\tThe reader was created successfully for app package Microsoft.SecHealthUI_1000.29628.1000.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppxPackaging/Operational\tMicrosoft-Windows-AppxPackagingOM\n05.09.2026 08:33:46.765\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:46.766\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:46.767\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:55.532\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:55.532\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:55.533\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:55.533\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:59.123\t1808\t\"This device has updated Secure Boot CA/keys. This device signature information is included here.\nDeviceAttributes: BaseBoardManufacturer:HONOR;OEMModelNumber:FRG-X;OEMModelBaseBoard:FRG-X-PCB;OEMManufacturerName:HONOR;FirmwareVersion:2.03;OSArchitecture:amd64;\nBucketId: 2b1354b7771d78c79e9e89aa0f38e845e4df59f22f64c8dd0ede9c278c781587\nBucketConfidenceLevel: High Confidence\nUpdateType: Windows UEFI CA 2023 (DB), Option ROM CA 2023 (DB), 3P UEFI CA 2023 (DB), KEK 2023, Boot Manager (2023)\nFor more information, please see https://go.microsoft.com/fwlink/?linkid=2301018.\"\tInformation\tSystem\tMicrosoft-Windows-TPM-WMI\n05.09.2026 08:33:59.223\t8001\t\"Skipping license manager: PFN Microsoft.WindowsFeedbackHub_2.2606.702.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:34:04.296\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:34:04.296\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:34:04.296\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:34:04.304\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:34:05.474\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:05.474\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:05.507\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:05.508\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:05.508\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:05.509\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:05.509\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:05.509\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:05.511\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:05.512\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p -s wlidsvc( #0x0/0x18280 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:34:05.513\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:05.513\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:05.513\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:05.563\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.413\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.414\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.414\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.414\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.414\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.414\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.414\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.414\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.415\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.415\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.415\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.415\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.415\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.415\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.415\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.416\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tRead Credential\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.420\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.421\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.421\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.421\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.421\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.421\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.421\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.421\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.422\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.422\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.422\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.422\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.422\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.425\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.425\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.426\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.426\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.426\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.426\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.426\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.426\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.426\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.427\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.427\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.427\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.427\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.428\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.428\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.475\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.475\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.476\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.476\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.476\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.476\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.477\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.477\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.477\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.477\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.477\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.477\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.478\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.478\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.149\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-544\n\tGroup Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u044b\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0xc38\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.160\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:34:07.174\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.175\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.175\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.176\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.177\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p -s wlidsvc( #0x0/0x18280 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:34:07.178\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.610\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.610\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.610\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.610\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.611\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.611\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.611\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.611\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.611\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.611\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.611\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.612\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.612\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.612\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.612\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.612\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tRead Credential\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.618\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.618\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.618\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.619\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.619\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.619\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.619\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.619\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.619\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.619\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.620\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.620\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.620\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.623\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.623\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.623\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.624\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.624\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.624\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.624\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.624\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.625\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.625\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.625\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.625\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.625\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.626\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.626\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.653\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.653\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.653\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.653\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.654\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.654\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.654\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.654\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.654\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.654\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.654\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.655\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.655\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.655\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.802\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-544\n\tGroup Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u044b\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0xc38\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.811\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:34:20.214\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:34:41.487\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:34:41.488\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:34:41.488\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:34:50.270\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:34:50.270\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:34:50.277\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:34:50.277\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:34:59.056\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:34:59.056\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:34:59.056\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:34:59.063\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:25.430\t179\tReceived session display notification\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:35:27.546\t1005\tThe Connection Provider status changed to Disconnected.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:27.546\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:27.546\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:27.561\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:27.578\t1113\tDevice Compact Ticket request completed with Device Id 00180018E4F8342E for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:27.591\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:27.679\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:27.679\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:36.291\t10\t\tError\tIntel-Gfx-Display-External/GfxDisplayExEventViewer\tIntel-Gfx-Display-External\n05.09.2026 08:35:36.330\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:35:36.345\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:35:36.455\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:36.456\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:36.476\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:36.476\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:36.701\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:35:36.701\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:35:39.921\t505\t\"Compatibility fix applied to C:\\Windows\\ImmersiveControlPanel\\SystemSettings.exe.\nFix information: Microsoft Apps, {15a89f9e-4f3e-4aa2-b026-7271def4f208}, 0x80010101.\"\tInformation\tMicrosoft-Windows-Application-Experience/Program-Telemetry\tMicrosoft-Windows-Application-Experience\n05.09.2026 08:35:39.921\t505\t\"Compatibility fix applied to C:\\Windows\\ImmersiveControlPanel\\SystemSettings.exe.\nFix information: Microsoft Apps, {f4db680c-9c1e-4a31-b6b0-3be6bfd4f55f}, 0x80010101.\"\tInformation\tMicrosoft-Windows-Application-Experience/Program-Telemetry\tMicrosoft-Windows-Application-Experience\n05.09.2026 08:35:40.450\t179\tReceived session display notification\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:35:40.450\t1025\tA Power event was fired: MonitorSettingChange [PowerEventType] false [Enabled].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:40.450\t566\t\"The system session has transitioned from 0 to 1.\n\nReason SessionUnlock \n\nBootId: 82\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Power\n05.09.2026 08:35:40.451\t506\t\"The system is entering Modern Standby \n\nReason: Idle Timeout.\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Power\n05.09.2026 08:35:40.591\t8100\tStarting validation and setting the Trust Label on package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:35:40.594\t8106\tPackage Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe has Trust Label already. Flags: 0x103\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:35:40.594\t8101\tFinished validation and setting the Trust Label on package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:35:40.848\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x10c4\n\tProcess Name:\t\tC:\\Windows\\System32\\LogonUI.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:35:41.113\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"23528CA76A0\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:35:41.118\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"LockApp\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:35:41.223\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:35:41.223\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:35:41.305\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:35:41.305\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:35:41.591\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:35:41.591\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:35:41.671\t8100\tStarting validation and setting the Trust Label on package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:35:41.672\t8106\tPackage Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe has Trust Label already. Flags: 0x103\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:35:41.672\t8101\tFinished validation and setting the Trust Label on package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:35:43.017\t1402\tData Store Cache secondary data reconciliation start.\tInformation\tMicrosoft-Windows-ShellCommon-StartLayoutPopulation/Operational\tMicrosoft-Windows-ShellCommon-StartLayoutPopulation\n05.09.2026 08:35:43.021\t1403\tData Store Cache secondary data reconciliation end.\tInformation\tMicrosoft-Windows-ShellCommon-StartLayoutPopulation/Operational\tMicrosoft-Windows-ShellCommon-StartLayoutPopulation\n05.09.2026 08:35:43.043\t3000\tTile session creation is requested for C:\\Windows\\System32\\RuntimeBroker.exe endpoint 0x0.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:43.043\t3001\tTile session creation is finished for C:\\Windows\\System32\\RuntimeBroker.exe from endpoint 0x0 with result The operation completed successfully., and 3 is assigned as session id. Queued Closes = 0, Queued Cleanups = 0\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:44.674\t2416\tA local notification was received from MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets [AppUserModelId] with a 0 [NotificationId] through an application endpoint.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:44.678\t2418\tA local notification was submitted to threadpool: MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets [AppUserModelId] tile [NotificationType] 9398 [NotificationTrackingId] Local [NotificationSource].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:44.694\t3053\ttile with notification tracking id 9398 is being delivered to MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:45.254\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:45.254\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:45.254\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:45.262\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:46.346\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"23528CA76A0\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:35:46.350\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:00.105\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:01.893\t211\tAdded process 9584 to Desktop AppX container 245cdaf2-a8c9-11f1-b7ff-289200f24a99 for package MicrosoftWindows.Client.CBS_1000.26100.344.0_x64__cw5n1h2txyewy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:36:04.598\t219\tPSMFlags for Desktop AppX process %1 with applicationID %2 is %3.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:36:04.615\t201\tCreated process 19360 for application Microsoft.Office.ActionsServer_8wekyb3d8bbwe!Microsoft.Office.ActionsServer in package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe. [FinishPackageActivation]\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:36:04.634\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:36:04.634\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:36:04.652\t6006\t\"Process Name: C:\\WINDOWS\\System32\\svchost.exe\nModule Name: c:\\windows\\system32\\pushtoinstall.dll\nBuild: 26100.1.amd64fre.ge_release.240331-1435\n\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Push-To-Install-Service\n05.09.2026 08:36:04.652\t6004\t\"canDisableApps value is 0\nError Code: Unknown HResult Error code: 0xefffffff\nFunction: InitStoreAppsAreDisabled\nSource: onecoreuap\\enduser\\winstore\\pushtoinstall\\svc\\svcmain.cpp (58)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Push-To-Install-Service\n05.09.2026 08:36:04.652\t6004\t\"PTI started with registration\nError Code: Unknown HResult Error code: 0xefffffff\nFunction: ServiceInitialize\nSource: onecoreuap\\enduser\\winstore\\pushtoinstall\\lib\\service.cpp (338)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Push-To-Install-Service\n05.09.2026 08:36:04.652\t6004\t\"Attempting to register with the notification service.\nError Code: Unknown HResult Error code: 0xefffffff\nFunction: RegisterForWns\nSource: onecoreuap\\enduser\\winstore\\pushtoinstall\\lib\\wnschannel.cpp (21)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Push-To-Install-Service\n05.09.2026 08:36:04.712\t2000\t\"Process Name: C:\\WINDOWS\\system32\\taskhostw.exe\nModule Name: C:\\Windows\\System32\\InstallServiceTasks.dll\nBuild: 26100.1.amd64fre.ge_release.240331-1435, UBR: 9168\n\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.712\t2006\t\"Setting MSA Client Id for Token requests: {f0c62012-2cef-4831-b1f7-930682874c86}\nError: Unspecified error\nFunction: \nSource: onecoreuap\\enduser\\winstore\\auth\\lib\\winstoreauth.cpp (206)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.728\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:04.728\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:04.729\t1025\tA Power event was fired: BatterySaverStateChange [PowerEventType] false [Enabled].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:04.729\t1025\tA Power event was fired: ACPowerChange [PowerEventType] true [Enabled].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:04.729\t1025\tA Power event was fired: MonitorSettingChange [PowerEventType] false [Enabled].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:04.729\t1025\tA Power event was fired: OpportunisticConnectedStandbyStateChange [PowerEventType] false [Enabled].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:04.732\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:04.735\t1113\tDevice Compact Ticket request completed with Device Id 00180018E4F8342E for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:04.749\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:04.750\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:04.750\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:04.772\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:04.789\t2005\t\"oneSettingsconcurrentDefaultInstalls = 3, oneSettingsconcurrentMinInstalls = 3\nError: Unknown HResult Error code: 0xefffffff\nFunction: GetConcurrentInstallsFromOneSettings\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (763)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2005\t\"OneSettingsOnlineScanInterval (in seconds) = 86400\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1220)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2005\t\"OneSettingsOnlineScansAllowedInInterval = 10\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1222)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2005\t\"OneSettingsOnlineScanCooldown (in seconds) = 30\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1243)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (537)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (537)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (556)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (556)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (537)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2005\t\"DirectDownloadEnablementState fetched from cache: 2\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadDirectDownloadEnablementState\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2867)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2005\t\"DirectDownloadEnablementSettings fetched from OneSettings payload: [{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[\"\"Install\"\"],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[\"\"Microsoft.WindowsStore_8wekyb3d8bbwe\"\"],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[\"\"9NKSQGP7F2NH\"\",\"\"9NRX63209R7B\"\",\"\"9NTXR16HNW1T\"\",\"\"9PLM9XGG6VKS\"\"],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[\"\"0x00000000\"\",\"\"0x80004004\"\",\"\"0x80070032\"\",\"\"0x8007029C\"\",\"\"0x8007045B\"\",\"\"0x80070520\"\",\"\"0x80073CFB\"\",\"\"0x80073CFF\"\",\"\"0x80073D0A\"\",\"\"0x80073D13\"\",\"\"0x80073D19\"\",\"\"0x80073D22\"\",\"\"0x80240008\"\",\"\"0x8024001E\"\",\"\"0x80240066\"\",\"\"0x803FB003\"\",\"\"0x803FB015\"\",\"\"0xC8000710\"\",\"\"0x80073CF4\"\",\"\"0x80073D01\"\",\"\"0x80070070\"\",\"\"0x80073D21\"\",\"\"0x80246017\"\",\"\"0x80073CFE\"\"],\"\"regions\"\":[],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[\"\"9PLRGHGXR4FM\"\"],\"\"arches\"\":[],\"\"installTypes\"\":[\"\"Install\"\"],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Allowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[\"\"CN\"\"],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[\"\"9N3RK8ZV2ZR8\"\",\"\"9NRZT3Q9R3DL\"\",\"\"9P2B8MCSVPLN\"\",\"\"9NPV76S164X5\"\",\"\"9NBLGGH4RV3P\"\",\"\"9NBLGGH4SVJT\"\",\"\"9PHBC65ZG12V\"\",\"\"9NKSQGP7F2NH\"\",\"\"9NKRJ3SJ9SDG\"\"],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[\"\"DellInc.AlienwareCommandCenter_htrsf667h5kn2\"\",\"\"DSIC\"\",\"\"explorer\"\",\"\"AICompanion\"\",\"\"HP.Omen.OmenCommandCenter\"\",\"\"setup\"\",\"\"Language Overlay Service\"\",\"\"TabTip\"\",\"\"LiveCaptions\"\",\"\"Undetermined\"\",\"\"GamingService\"\"],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[\"\"Install\"\"],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Allowed\"\"}]\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadDirectDownloadEnablementSettings\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2891)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2944)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2007\t\"Error while reading DirectDownloadReplacementSettings from OneSettings cache, value will remain empty\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1360)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2005\t\"DirectDownloadEnablementLiveCheckThreshold in milliseconds fetched from cache: 600000\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadDirectDownloadEnablementLiveCheckThreshold\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (3005)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2005\t\"ProductCatalogUrl fetched from cache: https://fe3cr.delivery.mp.microsoft.com/ClientWebService/client.asmx/secured\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadProductCatalogUrl\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (3027)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2005\t\"SfEdgeFallbackEndpointUrl fetched from cache: https://sfdataservice.microsoft.com/package-retrieval\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadSfEdgeFallbackEndpointUrl\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (3048)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2005\t\"CheckpointAbandonmentRules fetched from OneSettings payload: [{\"\"callerApplicationIdKeyword\"\":\"\"WindowsStore\"\",\"\"systemAttemptCountThreshold\"\":5,\"\"creationTimestampThresholdInDays\"\":2},{\"\"callerApplicationIdKeyword\"\":\"\"MoUsoCoreWorker\"\",\"\"systemAttemptCountThreshold\"\":2,\"\"creationTimestampThresholdInDays\"\":2}]\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadCheckpointAbandonmentRules\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (3235)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (556)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (575)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"Update block list not found or empty in OneSettings\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1457)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"[Telemetry]: Stats :: AppControlPreferenceOptions = 99 \u00a0ShouldHonorAppUpdatePauseFlags = 0 \u00a0\nError: Unknown HResult Error code: 0xefffffff\nFunction: LogTelemetryEvent\nSource: onecoreuap\\enduser\\winstore\\installservice\\tasksdll\\logging.cpp (10)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"[Telemetry]: Stats :: AppControlPreferenceOptions = 99 \u00a0ShouldHonorAppUpdatePauseFlags = 0 \u00a0\nError: Unknown HResult Error code: 0xefffffff\nFunction: LogTelemetryEvent\nSource: onecoreuap\\enduser\\winstore\\installservice\\tasksdll\\logging.cpp (10)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.831\t2006\t\"USO store provider is enabled.\nError: Unknown HResult Error code: 0xefffffff\nFunction: CanUseUsoStoreProvider\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2574)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.874\t265\t1 predictions were fetched for transforms '' and PCRs 7,11. USN: 0, Matching PCRs: 1,2,3,4,5,6,7,8,9,10,11.\tInformation\tMicrosoft-Windows-PCRPF/PCRPF\tMicrosoft-Windows-PCRPF\n05.09.2026 08:36:05.455\t16394\tOffline downlevel migration succeeded.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 08:36:06.022\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:36:06.022\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:36:06.102\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:36:06.102\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:36:06.125\t8025\tThe Microsoft Passport service started successfully.\t16\tMicrosoft-Windows-HelloForBusiness/Operational\tMicrosoft-Windows-HelloForBusiness\n05.09.2026 08:36:06.132\t5382\t\"Vault credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nThis event occurs when a user reads a stored vault credential.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:36:06.133\t1600\t\"The Windows Biometric Service failed to start its secure component.\n\nReason for unavailability: 76.\n\nThe operation failed with error: 0x80070032.\"\tInformation\tMicrosoft-Windows-Biometrics/Operational\tMicrosoft-Windows-Biometrics\n05.09.2026 08:36:06.153\t1108\t\"The Windows Biometric Service successfully created a Biometric Unit for sensor: Windows Hello Face Virtual Software Device (\\Bootstrap\\Virtual Sensors\\{0527b250-7514-4321-8b68-41c65f956998})\n\nThe sensor's mode is \"\"Basic,\"\" its pool-type is \"\"System,\"\" and it's isolated in a \"\"Local System\"\" process.\n\nSee the \"\"Details\"\" pane for additional information about the sensor's new configuration.\"\tVerbose\tMicrosoft-Windows-Biometrics/Operational\tMicrosoft-Windows-Biometrics\n05.09.2026 08:36:06.158\t1108\t\"The Windows Biometric Service successfully created a Biometric Unit for sensor: Analog NUI Voice Virtual Sensor (\\Voice\\Virtual Sensors\\{F25AB4A2-593A-4A89-B9FF-8144BEA81E15})\n\nThe sensor's mode is \"\"Basic,\"\" its pool-type is \"\"System,\"\" and it's isolated in a \"\"Local System\"\" process.\n\nSee the \"\"Details\"\" pane for additional information about the sensor's new configuration.\"\tVerbose\tMicrosoft-Windows-Biometrics/Operational\tMicrosoft-Windows-Biometrics\n05.09.2026 08:36:06.160\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2194\n\tProcess Name:\t\tC:\\Windows\\System32\\DeviceCensus.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:36:06.168\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Passport Key Storage Provider\n \tKey Name:\tS-1-5-21-3712849175-2219398513-4278588552-1003/37b5cc48-d2d4-4aab-93e7-8e74ef7366bd/login.live.com//8aa0580351688ef0\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090011\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:36:06.169\t5382\t\"Vault credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nThis event occurs when a user reads a stored vault credential.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:36:06.171\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1009\n\tAccount Name:\t\tWsiAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2194\n\tProcess Name:\t\tC:\\Windows\\System32\\DeviceCensus.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:36:06.176\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Passport Key Storage Provider\n \tKey Name:\tS-1-5-21-3712849175-2219398513-4278588552-1003/37b5cc48-d2d4-4aab-93e7-8e74ef7366bd/login.live.com//8aa0580351688ef0\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090011\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:36:06.177\t5382\t\"Vault credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nThis event occurs when a user reads a stored vault credential.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:36:06.209\t5000\t\"TPM Manufacturer: Intel\nVersion: 2.0\nFirmware Version: 700.19.18.2682\nIs Ready: true\"\tInformation\tMicrosoft-Windows-HelloForBusiness/Operational\tMicrosoft-Windows-HelloForBusiness\n05.09.2026 08:36:06.537\t2000\t\"Process Name: C:\\WINDOWS\\system32\\devicecensus.exe\nModule Name: C:\\Windows\\System32\\InstallService.dll\nBuild: 26100.1.amd64fre.ge_release.240331-1435, UBR: 9168\n\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:06.537\t2006\t\"Setting MSA Client Id for Token requests: {f0c62012-2cef-4831-b1f7-930682874c86}\nError: Unspecified error\nFunction: \nSource: onecoreuap\\enduser\\winstore\\auth\\lib\\winstoreauth.cpp (206)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:06.564\t2005\t\"oneSettingsconcurrentDefaultInstalls = 3, oneSettingsconcurrentMinInstalls = 3\nError: Unknown HResult Error code: 0xefffffff\nFunction: GetConcurrentInstallsFromOneSettings\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (763)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:06.571\t2006\t\"request: Microsoft.WindowsStore CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US\nError: Unknown HResult Error code: 0xefffffff\nFunction: Windows::ApplicationModel::Store::Preview::InstallControl::AppInstallManagerImpl::IsStoreBlockedByPolicyAsync\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\appinstallcontrol.cpp (1995)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:06.572\t2006\t\"result: Microsoft.WindowsStore, CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US, blocked = false\nError: The operation completed successfully.\nFunction: Windows::ApplicationModel::Store::Preview::InstallControl::AppInstallManagerImpl::IsStoreBlockedByPolicyAsync::::operator ()\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\appinstallcontrol.cpp (2026)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:11.338\t102\tClipSVC service has shutdown.\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 08:36:13.069\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:13.508\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:13.508\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:13.509\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:13.509\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:13.783\t6003\t\"\nError Code: Unknown HResult Error code: 0x880403e9\nFunction: \nSource: onecoreuap\\enduser\\winstore\\pushtoinstall\\lib\\wnschannel.cpp (61)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Push-To-Install-Service\n05.09.2026 08:36:13.788\t6004\t\"onecoreuap\\enduser\\winstore\\pushtoinstall\\lib\\wnschannel.cpp(61)\\pushtoinstall.dll!00007FFB9CD77527: (caller: 00007FFB9CD72A54) Exception(1) tid(6f8) 880403E9 \nError Code: Unknown HResult Error code: 0x880403e9\nFunction: \nSource: onecoreuap\\enduser\\winstore\\pushtoinstall\\lib\\service.cpp (293)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Push-To-Install-Service\n05.09.2026 08:36:14.291\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:14.512\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:14.957\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:15.179\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:16.846\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:22.285\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:22.286\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:22.286\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:22.299\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:22.301\t1264\tAdding new user to the Windows Push Notification Service completed. 00180018E4F8342E [DeviceId] 0 [UserId] 0x8004ACB3 [ErrorCode].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:22.301\t1005\tThe Connection Provider status changed to Disconnected.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:22.301\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:22.301\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:22.315\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:22.319\t1113\tDevice Compact Ticket request completed with Device Id 00180018E4F8342E for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:22.351\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:22.357\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:22.357\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:22.417\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:22.572\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:36:22.572\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:36:25.188\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:25.412\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:25.524\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:25.744\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:25.966\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:26.196\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:26.412\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:26.636\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:26.862\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:26.973\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:27.192\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:27.420\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:27.531\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:27.645\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:29.310\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:30.981\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:31.138\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:31.138\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:31.139\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:31.139\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:32.319\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:33.547\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:36.188\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, Win32_DeviceGuard, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:36:36.330\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:39.911\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:39.911\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:39.911\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:39.921\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:40.348\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:42.686\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:43.024\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:43.244\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:44.246\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:44.471\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:44.728\t3056\tTile Notification are being cleared for MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets - informed session 3.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:46.477\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:47.365\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:06.198\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, WhqlProvider, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:37:06.200\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, InvProv, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:37:06.202\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, DeliveryOptimizationMIProv, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:37:10.079\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:10.303\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:10.524\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:10.859\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:12.042\t16384\tSuccessfully scheduled Software Protection service for re-start at 2126-08-12T01:37:12Z. Reason: RulesEngine.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 08:37:12.531\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:13.640\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:14.861\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:15.418\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:17.632\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:19.847\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:20.175\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:22.053\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:22.716\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:23.590\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:24.817\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:25.477\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:25.698\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:26.702\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:35.057\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:35.392\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:35.729\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:36.064\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:36.210\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, Win32_TpmProvider, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:37:36.622\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:36.843\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:37.394\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:37.605\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:37.939\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:38.161\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:38.385\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:39.053\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:39.274\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:39.605\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:39.942\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:40.612\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:41.055\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:41.830\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:42.056\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:42.278\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:42.503\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:42.727\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:42.949\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:43.173\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:43.397\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:43.720\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:44.157\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:44.382\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:44.770\t3056\tTile Notification are being cleared for MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets - informed session 3.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:37:45.164\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:45.384\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:45.606\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:45.834\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:46.054\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:46.499\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:46.940\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:47.386\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:47.833\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:48.817\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:49.037\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:49.263\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:49.928\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:50.153\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:50.375\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:51.152\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:51.379\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:51.603\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:51.945\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:52.149\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:52.364\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:52.702\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:52.921\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:53.130\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:58.461\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:06.208\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, WMIProv, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:38:15.035\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:20.928\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:21.146\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:21.693\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:22.139\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:22.815\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:23.147\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:23.592\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:24.702\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:25.258\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:26.695\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:26.902\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:27.346\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:28.126\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:28.455\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:28.675\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:28.899\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:29.901\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:31.225\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:31.441\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:31.774\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:31.998\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:32.220\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:33.222\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:33.780\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:34.111\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:34.444\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:35.231\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:37.445\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:37.665\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:39.345\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:39.565\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:39.898\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:40.230\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:40.565\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:40.786\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:41.013\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:41.685\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:42.132\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:43.024\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:43.243\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:43.570\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:44.117\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:44.471\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:44.782\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:44.802\t3056\tTile Notification are being cleared for MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets - informed session 3.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:38:45.448\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:47.317\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:56.881\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:02.055\t219\tPSMFlags for Desktop AppX process %1 with applicationID %2 is %3.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:39:02.079\t201\tCreated process 13580 for application Microsoft.Office.ActionsServer_8wekyb3d8bbwe!Microsoft.Office.ActionsServer in package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe. [FinishPackageActivation]\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:39:02.146\t211\tAdded process 5116 to Desktop AppX container 245cdaf2-a8c9-11f1-b7ff-289200f24a99 for package MicrosoftWindows.Client.CBS_1000.26100.344.0_x64__cw5n1h2txyewy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:39:02.362\t8100\tStarting validation and setting the Trust Label on package MSTeams_26093.415.4620.1935_x64__8wekyb3d8bbwe with flags 0x122.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:39:02.372\t8101\tFinished validation and setting the Trust Label on package MSTeams_26093.415.4620.1935_x64__8wekyb3d8bbwe with flags 0x122.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:39:02.389\t8100\tStarting validation and setting the Trust Label on package Microsoft.Windows.Photos_2026.11060.2004.0_x64__8wekyb3d8bbwe with flags 0x122.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:39:02.391\t8106\tPackage Microsoft.Windows.Photos_2026.11060.2004.0_x64__8wekyb3d8bbwe has Trust Label already. Flags: 0x122\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:39:02.391\t8101\tFinished validation and setting the Trust Label on package Microsoft.Windows.Photos_2026.11060.2004.0_x64__8wekyb3d8bbwe with flags 0x122.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:39:02.392\t8000\t\"Process Name: C:\\WINDOWS\\system32\\svchost.exe\nModule Name: C:\\WINDOWS\\SYSTEM32\\licensemanagerapi.dll\nBuild: 26100.1.amd64fre.ge_release.240331-1435\n\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:39:02.392\t8001\t\"canDisableApps value is 0\nFunction: InitStoreAppsAreDisabled\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (195)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:39:02.393\t8001\t\"Skipping license manager: PFN Microsoft.Windows.Photos_2026.11060.2004.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:39:02.411\t8100\tStarting validation and setting the Trust Label on package Microsoft.Paint_11.2605.71.0_x64__8wekyb3d8bbwe with flags 0x122.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:39:02.413\t8106\tPackage Microsoft.Paint_11.2605.71.0_x64__8wekyb3d8bbwe has Trust Label already. Flags: 0x122\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:39:02.413\t8101\tFinished validation and setting the Trust Label on package Microsoft.Paint_11.2605.71.0_x64__8wekyb3d8bbwe with flags 0x122.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:39:02.414\t8001\t\"Skipping license manager: PFN Microsoft.Paint_11.2605.71.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:39:02.424\t8100\tStarting validation and setting the Trust Label on package Microsoft.MicrosoftOfficeHub_19.2607.44041.0_x64__8wekyb3d8bbwe with flags 0x122.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:39:02.426\t8106\tPackage Microsoft.MicrosoftOfficeHub_19.2607.44041.0_x64__8wekyb3d8bbwe has Trust Label already. Flags: 0x122\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:39:02.426\t8101\tFinished validation and setting the Trust Label on package Microsoft.MicrosoftOfficeHub_19.2607.44041.0_x64__8wekyb3d8bbwe with flags 0x122.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:39:02.427\t8001\t\"Skipping license manager: PFN Microsoft.MicrosoftOfficeHub_19.2607.44041.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:39:02.453\t8100\tStarting validation and setting the Trust Label on package Microsoft.MicrosoftEdge.Stable_152.0.4191.53_neutral__8wekyb3d8bbwe with flags 0x122.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:39:02.455\t8101\tFinished validation and setting the Trust Label on package Microsoft.MicrosoftEdge.Stable_152.0.4191.53_neutral__8wekyb3d8bbwe with flags 0x122.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:39:02.464\t8100\tStarting validation and setting the Trust Label on package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe with flags 0x122.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:39:02.466\t8101\tFinished validation and setting the Trust Label on package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe with flags 0x122.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:39:02.476\t8100\tStarting validation and setting the Trust Label on package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe with flags 0x122.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:39:02.478\t8101\tFinished validation and setting the Trust Label on package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe with flags 0x122.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:39:04.326\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, WhqlProvider, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:39:05.105\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:05.550\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:06.381\t800\tMaintenance state changed to 3 (Last Run: \u200e05.\u200e09.\u200e2026 8:39).\tInformation\tMicrosoft-Windows-TaskScheduler/Maintenance\tMicrosoft-Windows-TaskScheduler\n05.09.2026 08:39:06.919\t1018\t\"ReadyBoot disk assessment completed in 563 ms.\n     Disk Assessment Timestamp: \u200e2026\u200e-\u200e09\u200e-\u200e05T08:39:06.368586900Z\n     Result: 0x44C\"\tInformation\tMicrosoft-Windows-ReadyBoost/Operational\tMicrosoft-Windows-ReadyBoost\n05.09.2026 08:39:06.947\t90\t\"Settings detail.\nsource = LogonIdleTask.\npackageIdToDelete = .\npackagePathsToAdd = .\"\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:07.011\t800\tMaintenance state changed to 1 (Last Run: \u200e05.\u200e09.\u200e2026 8:39).\tInformation\tMicrosoft-Windows-TaskScheduler/Maintenance\tMicrosoft-Windows-TaskScheduler\n05.09.2026 08:39:07.044\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:39:07.044\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:39:07.069\t4019\tDcSvc: Service is being initialized.\tInformation\tMicrosoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Operational\tMicrosoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider\n05.09.2026 08:39:07.069\t4009\tDcSvc: Service status updated. Current state: (0x2), Exit code: (0x0), Wait hint: (0x64).\tInformation\tMicrosoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Operational\tMicrosoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider\n05.09.2026 08:39:07.069\t4000\tDcSvc: Successfully initialized service. Result: (The operation completed successfully.).\tInformation\tMicrosoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Operational\tMicrosoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider\n05.09.2026 08:39:07.069\t4009\tDcSvc: Service status updated. Current state: (0x4), Exit code: (0x0), Wait hint: (0x0).\tInformation\tMicrosoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Operational\tMicrosoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider\n05.09.2026 08:39:07.748\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:39:07.748\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:39:07.767\t4116\tStarted the Group Policy service initialization phase.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:39:07.771\t4115\tGroup Policy Service started.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:39:07.772\t5324\tGroup Policy received the notification CreateSession from Winlogon for session 0.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:39:07.772\t5351\tGroup policy session returned to winlogon.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:39:07.773\t4117\tGroup Policy Session started.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:39:07.775\t5351\tGroup policy session returned to winlogon.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:39:07.776\t4117\tGroup Policy Session started.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:39:07.777\t5116\tSuccessfully completed the Group Policy Service initialization phase.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:39:07.778\t5117\tGroup policy session completed successfully.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:39:07.778\t5320\tThe Group Policy Client service is currently configured as a standalone service.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:39:07.778\t5320\tInitializing and reading current service configuration for the Group Policy Client service.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:39:07.778\t5320\tInitializing service instance state to detect previous instances of the service.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:39:07.778\t5321\tA previous instance of the Group Policy Client Service was detected. Parameter: f6220be5-9108-4ed7-bae9-40e6046eeaa4\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:39:07.779\t5117\tGroup policy session completed successfully.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:39:07.808\t16\tThe access history in hive \\??\\C:\\ProgramData\\Microsoft\\Provisioning\\Microsoft-Desktop-Provisioning-Sequence.dat was cleared updating 0 keys and creating 0 modified pages.\tInformation\tSystem\tMicrosoft-Windows-Kernel-General\n05.09.2026 08:39:08.005\t20\tApplying package 'Power.EnergyEstimationEngine.Control.ppkg' ID: {1e05dd5d-a022-46c5-963c-b20de341170f}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.011\t20\tApplying package 'Power.EnergyEstimationEngine.CPU.ppkg' ID: {c5dc3753-b6c8-4057-b396-bf13d769311c}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.016\t20\tApplying package 'Power.EnergyEstimationEngine.Display.ppkg' ID: {ee4aac98-c174-4941-82b1-d121e493e4fb}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.021\t20\tApplying package 'Power.EnergyEstimationEngine.MBB.ppkg' ID: {99b095d8-5959-4820-bea7-7448c8427b4e}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.028\t20\tApplying package 'Power.EnergyEstimationEngine.StandbyActivation.ppkg' ID: {8d196d7f-3eef-48ad-8bea-be749f12d3ad}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.034\t20\tApplying package 'Power.EnergyEstimationEngine.Storage.ppkg' ID: {9aec5bda-1e87-46b3-bb96-1a01c606555e}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.039\t20\tApplying package 'Power.EnergyEstimationEngine.Telemetry.ppkg' ID: {8fb7d64e-70fc-4f9d-89ee-d486817534df}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.045\t20\tApplying package 'Power.EnergyEstimationEngine.Wifi.ppkg' ID: {b0b9123d-7d7f-4c6b-9973-ceced46f2a09}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.050\t20\tApplying package 'Power.Settings.Battery.ppkg' ID: {7a30a9be-737f-47a1-a541-6e7b0761ed19}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.054\t20\tApplying package 'Power.Settings.Button.ppkg' ID: {18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.059\t20\tApplying package 'Power.Settings.Control.ppkg' ID: {5f568920-10ad-4dc0-a97e-b78a3255c351}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.064\t20\tApplying package 'Power.Settings.Disk.ppkg' ID: {9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.070\t20\tApplying package 'Power.Settings.Display.ppkg' ID: {23cb517f-5073-4e96-a202-7fe6122a2271}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.076\t20\tApplying package 'Power.Settings.Graphics.ppkg' ID: {bf56ce5a-946b-45b5-858a-1794eb0125e2}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.081\t20\tApplying package 'Power.Settings.IdleResiliency.ppkg' ID: {f11899f2-71ec-4621-9997-e17ae2f6eb26}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.088\t20\tApplying package 'Power.Settings.PCIExpress.ppkg' ID: {268c43e1-aa2b-4036-86ef-8cda98a0c2fe}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.093\t20\tApplying package 'Power.Settings.Processor.Amd.ppkg' ID: {fc01e91f-914c-45af-9d7c-0b2e5fbedf63}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.099\t20\tApplying package 'Power.Settings.Processor.Intel.ppkg' ID: {fc01e91f-914c-45af-9d7c-0b2e5fbedf64}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.104\t20\tApplying package 'Power.Settings.Processor.ppkg' ID: {fc01e91f-914c-45af-9d7c-0b2e5fbedf62}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.109\t20\tApplying package 'Power.Settings.Sleep.ppkg' ID: {3742e5e8-6d9d-473b-99a6-8ecc0f43548a}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.114\t20\tApplying package 'SecureStart.Settings.ppkg' ID: {eb7d7f2f-3b77-4b87-b301-fd0d336f709a}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.122\t20\tApplying package 'Microsoft.Windows.Cosa.Desktop.Client.ppkg' ID: {c8a326e4-f518-4f14-b543-97a57e1a975e}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.989\t1\tTenant P-ARIA-4bb4d6f7cafc4e9292f972dca2dcde42-bd019ee8-e59c-4b0f-a02c-84e72157a3ef-7485 has been registered for telemetry usage.\tInformation\tMicrosoft-Windows-UniversalTelemetryClient/Operational\tMicrosoft-Windows-UniversalTelemetryClient\n05.09.2026 08:39:08.999\t1\tTenant P-ARIA-5476d0c4a7a347909c4b8a13078d4390-f8bdcecf-243f-40f8-b7c3-b9c44a57dead-7230 has been registered for telemetry usage.\tInformation\tMicrosoft-Windows-UniversalTelemetryClient/Operational\tMicrosoft-Windows-UniversalTelemetryClient\n05.09.2026 08:39:13.004\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:28.578\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:29.543\t10016\t\"The \u0434\u043b\u044f \u043a\u043e\u043d\u043a\u0440\u0435\u0442\u043d\u043e\u0433\u043e \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f permission settings do not grant \u041b\u043e\u043a\u0430\u043b\u044c\u043d\u043e \u0410\u043a\u0442\u0438\u0432\u0430\u0446\u0438\u044f permission for the COM Server application with CLSID \n{9EA82395-E31B-41CA-8DF7-EC1CEE7194DF}\n and APPID \n{2ED83BAA-B2FD-43B1-99BF-E6149C622692}\n to the user NT AUTHORITY\\NETWORK SERVICE SID (S-1-5-20) from address LocalHost (\u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c LRPC) running in the application container \u041d\u0435\u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e SID (\u041d\u0435\u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e). This security permission can be modified using the Component Services administrative tool.\"\tWarning\tSystem\tMicrosoft-Windows-DistributedCOM\n05.09.2026 08:39:31.138\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:31.662\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:39:31.662\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:39:32.031\t16\tCounter 11 of instance ({00000000-0000-0000-0000-000000000000}, NULL, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:39:32.031\t16\tCounter 6 of instance ({00000000-0000-0000-0000-000000000000}, NULL, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:39:32.916\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:33.143\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:33.554\t26\tWindows Update successfully found 1 updates.\tInformation\tMicrosoft-Windows-WindowsUpdateClient/Operational\tMicrosoft-Windows-WindowsUpdateClient\n05.09.2026 08:39:33.554\t26\tWindows Update successfully found 0 updates.\tInformation\tMicrosoft-Windows-WindowsUpdateClient/Operational\tMicrosoft-Windows-WindowsUpdateClient\n05.09.2026 08:39:33.554\t44\tWindows Update started downloading an update.\tInformation\tSystem\tMicrosoft-Windows-WindowsUpdateClient\n05.09.2026 08:39:33.554\t41\tAn update was downloaded.\tInformation\tMicrosoft-Windows-WindowsUpdateClient/Operational\tMicrosoft-Windows-WindowsUpdateClient\n05.09.2026 08:39:33.555\t43\tInstallation Started: Windows has started installing the following update: \u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u0430 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0438\u044f \u0443\u0433\u0440\u043e\u0437 \u0434\u043b\u044f Microsoft Defender Antivirus \u2014 KB2267602 (\u0432\u0435\u0440\u0441\u0438\u044f 1.459.55.0) \u2014 \u0410\u043a\u0442\u0443\u0430\u043b\u044c\u043d\u044b\u0439 \u043a\u0430\u043d\u0430\u043b (\u0448\u0438\u0440\u043e\u043a\u0438\u0439 \u0432\u044b\u043f\u0443\u0441\u043a)\tInformation\tSystem\tMicrosoft-Windows-WindowsUpdateClient\n05.09.2026 08:39:33.586\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:34.111\t1005\tThe Connection Provider status changed to Disconnected.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:34.111\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:34.111\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:34.112\t1005\tThe Connection Provider status changed to Disconnected.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:34.112\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:34.112\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:34.127\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:34.130\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:34.135\t1113\tDevice Compact Ticket request completed with Device Id 00180018E4F8342E for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:34.175\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:34.189\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:34.189\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:34.257\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:37.401\t800\tMaintenance state changed to 3 (Last Run: \u200e05.\u200e09.\u200e2026 8:39).\tInformation\tMicrosoft-Windows-TaskScheduler/Maintenance\tMicrosoft-Windows-TaskScheduler\n05.09.2026 08:39:37.447\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:39:37.447\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:39:37.938\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:38.489\t800\tMaintenance state changed to 1 (Last Run: \u200e05.\u200e09.\u200e2026 8:39).\tInformation\tMicrosoft-Windows-TaskScheduler/Maintenance\tMicrosoft-Windows-TaskScheduler\n05.09.2026 08:39:38.496\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:39.348\t2000\t\"\u0410\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043d\u0430\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430 Microsoft Defender security intelligence version updated.\n \tCurrent security intelligence Version: 1.459.55.0\n \tPrevious security intelligence Version: 1.459.28.0\n \tSecurity intelligence Type: \u0410\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043d\u0430\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430\n \tUpdate Type: \u0420\u0430\u0437\u043d\u043e\u0441\u0442\u043d\u043e\u0435\n \tUser: NT AUTHORITY\\\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n \tCurrent Engine Version: 1.1.26080.3\n \tPrevious Engine Version: 1.1.26080.3\"\tInformation\tMicrosoft-Windows-Windows Defender/Operational\tMicrosoft-Windows-Windows Defender\n05.09.2026 08:39:39.348\t2000\t\"\u0410\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043d\u0430\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430 Microsoft Defender security intelligence version updated.\n \tCurrent security intelligence Version: 1.459.55.0\n \tPrevious security intelligence Version: 1.459.28.0\n \tSecurity intelligence Type: \u0410\u043d\u0442\u0438\u0448\u043f\u0438\u043e\u043d\u0441\u043a\u0430\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430\n \tUpdate Type: \u0420\u0430\u0437\u043d\u043e\u0441\u0442\u043d\u043e\u0435\n \tUser: NT AUTHORITY\\\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n \tCurrent Engine Version: 1.1.26080.3\n \tPrevious Engine Version: 1.1.26080.3\"\tInformation\tMicrosoft-Windows-Windows Defender/Operational\tMicrosoft-Windows-Windows Defender\n05.09.2026 08:39:39.454\t19\tInstallation Successful: Windows successfully installed the following update: \u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u0430 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0438\u044f \u0443\u0433\u0440\u043e\u0437 \u0434\u043b\u044f Microsoft Defender Antivirus \u2014 KB2267602 (\u0432\u0435\u0440\u0441\u0438\u044f 1.459.55.0) \u2014 \u0410\u043a\u0442\u0443\u0430\u043b\u044c\u043d\u044b\u0439 \u043a\u0430\u043d\u0430\u043b (\u0448\u0438\u0440\u043e\u043a\u0438\u0439 \u0432\u044b\u043f\u0443\u0441\u043a)\tInformation\tSystem\tMicrosoft-Windows-WindowsUpdateClient\n05.09.2026 08:39:39.495\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:39.717\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:39.813\t5007\t\"\u0410\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043d\u0430\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430 Microsoft Defender Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.\n \tOld value: HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\CoreService\\WdConfigHash = 0xCB77E2D1\n \tNew value: HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\CoreService\\WdConfigHash = 0x5855D937\"\tInformation\tMicrosoft-Windows-Windows Defender/Operational\tMicrosoft-Windows-Windows Defender\n05.09.2026 08:39:39.937\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:40.159\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:40.381\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:40.605\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:40.718\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:40.939\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:41.159\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:41.374\t15\tUpdated Windows Defender status successfully to SECURITY_PRODUCT_STATE_ON.\tInformation\tApplication\tSecurityCenter\n05.09.2026 08:39:41.380\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:41.605\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:41.934\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:42.159\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:42.382\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:42.606\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:42.717\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:42.942\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:42.982\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:42.983\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:42.996\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:42.996\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:43.162\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:43.388\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:43.641\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:43.839\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:44.057\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:44.279\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:44.502\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:44.722\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:44.853\t3056\tTile Notification are being cleared for MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets - informed session 3.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:44.943\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:45.176\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:45.389\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:45.615\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:45.834\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:46.058\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:46.279\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:46.483\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:46.706\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:46.930\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:47.151\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:47.374\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:47.598\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:47.817\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:47.973\t505\t\"Performance summary for Storport Device (Port = 0, Path = 0, Target = 0, Lun = 0) whose Corresponding Class Disk Device Guid is {d10f1580-d0d5-c67f-846a-8d6faaba20dc}:                 \nTotal IO:269588                 \nFor latency buckets of 128us, 256us, 512us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 512ms, 1000ms, 2000ms, 10000ms, 10000+ms,                 \nThe IO success counts are 181832, 57992, 13735, 4822, 4020, 4205, 2946, 36, 0, 0, 0, 0, 0, 0.                 \nThe IO failed counts are 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0.                 \nThe IO total latency (in 100ns) are 93759011, 97723116, 48268646, 33886515, 83711026, 341707622, 1030573359, 23610946, 0, 0, 0, 0, 0, 0.                 \nTotal Bytes Read:8018466816                 \nTotal Bytes Written:2129373184\"\tInformation\tMicrosoft-Windows-Storage-Storport/Operational\tMicrosoft-Windows-StorPort\n05.09.2026 08:39:47.973\t504\t\"Error summary for Storport Device (Port = 0, Path = 0, Target = 0, Lun = 0) whose Corresponding Class Disk Device Guid is {d10f1580-d0d5-c67f-846a-8d6faaba20dc}:                     \nThere were 3 total errors seen and 0 timeouts.                     \nThe last error seen had opcode 0x1A and completed with SrbStatus 0x6 and ScsiStatus 0x2.                     \nThe sense code was (0x5,0x24,0x0).                     \nThe latency was 1 ms.\"\tInformation\tMicrosoft-Windows-Storage-Storport/Operational\tMicrosoft-Windows-StorPort\n05.09.2026 08:39:48.042\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:48.271\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:48.484\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:48.708\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:48.928\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:49.151\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:49.371\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:49.593\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:49.817\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:50.154\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:50.401\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:50.596\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:50.821\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:51.156\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:51.376\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:51.709\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:51.768\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:51.769\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:51.769\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:51.787\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:51.931\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:52.158\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:52.486\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:52.713\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:52.930\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:53.157\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:53.376\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:53.489\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:53.829\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:53.934\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:54.157\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:54.492\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:54.824\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:55.045\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:55.265\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:55.491\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:55.711\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:55.936\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:56.158\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:56.382\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:56.599\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:56.691\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:56.904\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:57.155\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:57.351\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:57.573\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:57.792\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:58.014\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:58.235\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:58.456\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:58.680\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:58.900\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:59.126\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:59.349\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:59.569\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:59.789\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:00.012\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:00.233\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:00.344\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:00.567\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:00.798\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:01.023\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:01.126\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:01.348\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:01.570\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:02.018\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:02.239\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:02.458\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:02.682\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:03.166\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:03.347\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:03.575\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:03.794\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:04.351\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:04.576\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:04.793\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:05.022\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:05.244\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:05.460\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:05.685\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:05.795\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:06.017\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:06.351\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:06.466\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:06.685\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:06.879\t800\tMaintenance state changed to 3 (Last Run: \u200e05.\u200e09.\u200e2026 8:40).\tInformation\tMicrosoft-Windows-TaskScheduler/Maintenance\tMicrosoft-Windows-TaskScheduler\n05.09.2026 08:40:06.921\t800\tMaintenance state changed to 1 (Last Run: \u200e05.\u200e09.\u200e2026 8:40).\tInformation\tMicrosoft-Windows-TaskScheduler/Maintenance\tMicrosoft-Windows-TaskScheduler\n05.09.2026 08:40:08.029\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:12.157\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:19.480\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:20.378\t1002\tError 0x80070002 occurred while verifying known folder {0ddd015d-b06c-45d5-8c4c-f59713854639} with path 'C:\\WINDOWS\\system32\\config\\systemprofile\\Pictures'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:40:22.338\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:23.450\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:24.318\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:25.213\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:25.657\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:25.879\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:26.101\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:26.320\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:26.546\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:26.768\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:26.988\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:27.434\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:28.220\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:32.865\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:33.093\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:33.698\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:40:33.698\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:40:33.735\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:40:33.735\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:40:33.735\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:40:33.737\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:40:33.737\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:40:33.737\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:40:33.757\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:40:33.757\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:40:33.757\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:40:34.604\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:40:34.605\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:40:34.609\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:40:34.609\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:40:37.434\t800\tMaintenance state changed to 3 (Last Run: \u200e05.\u200e09.\u200e2026 8:40).\tInformation\tMicrosoft-Windows-TaskScheduler/Maintenance\tMicrosoft-Windows-TaskScheduler\n05.09.2026 08:40:37.474\t800\tMaintenance state changed to 1 (Last Run: \u200e05.\u200e09.\u200e2026 8:40).\tInformation\tMicrosoft-Windows-TaskScheduler/Maintenance\tMicrosoft-Windows-TaskScheduler\n05.09.2026 08:40:40.302\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:44.880\t3056\tTile Notification are being cleared for MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets - informed session 3.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:40:55.665\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:03.721\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:41:03.721\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:41:04.024\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:04.246\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:04.475\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:04.910\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:05.134\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:05.243\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:05.467\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:05.914\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:06.140\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:06.252\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:06.358\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:06.474\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:07.072\t4009\tDcSvc: Service status updated. Current state: (0x3), Exit code: (0x0), Wait hint: (0x0).\tInformation\tMicrosoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Operational\tMicrosoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider\n05.09.2026 08:41:07.074\t4009\tDcSvc: Service status updated. Current state: (0x1), Exit code: (0x0), Wait hint: (0x0).\tInformation\tMicrosoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Operational\tMicrosoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider\n05.09.2026 08:41:07.608\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:36.784\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:36.990\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, NetAdapterCim, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:41:37.102\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:37.431\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:37.642\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:37.866\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:38.088\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:40.204\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:40.977\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:41.628\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:42.517\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:44.079\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:44.741\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:44.905\t3056\tTile Notification are being cleared for MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets - informed session 3.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:41:48.969\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:49.638\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:50.533\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:51.748\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:52.524\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:52.744\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:53.862\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:55.778\t40961\tPowerShell console is starting up\tInformation\tMicrosoft-Windows-PowerShell/Operational\tMicrosoft-Windows-PowerShell\n05.09.2026 08:41:55.817\t53504\tWindows PowerShell has started an IPC listening thread on process: 11000 in AppDomain: DefaultAppDomain.\tInformation\tMicrosoft-Windows-PowerShell/Operational\tMicrosoft-Windows-PowerShell\n05.09.2026 08:41:55.834\t600\t\"Provider \"\"Registry\"\" is Started. \n\nDetails: \n\tProviderName=Registry\n\tNewProviderState=Started\n\n\tSequenceNumber=1\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=7246f244-6a24-4ffc-a54d-b05d2b9de908\n\tHostApplication=powershell.exe -ExecutionPolicy Restricted -Command \n $Res = 0\n $InboxIMEs = (@(\n '{0000897b-83df-4b96-be07-0fb58b01c4a4}','{03b5835f-f03c-411b-9ce2-aa23e1171e36}',\n '{531fdebf-9b4c-4a43-a2aa-960e8fcdc732}','{6a498709-e00b-4c45-a018-8f9e4081ae40}',\n '{7c472071-36a7-4709-88cc-859513e583a9}','{81d4e9c9-1d3b-41bc-9e6c-4b40bf79e35e}',\n '{81ea0a17-aa39-455b-ba20-ea79a8f98966}','{8613e14c-d0c0-4161-ac0f-1dd2563286bc}',\n '{a028ae76-01b1-46c2-99c4-acd9858ae02f}','{a1e2b86b-924a-4d43-80f6-8a820df7190f}',\n '{b115690a-ea02-48d5-a231-e3578d2fdf80}','{c2cb2cf0-af47-413e-9780-8bc3a3c16068}',\n '{dcbd6fa8-032f-11d3-b5b1-00c04fc324a1}','{e429b25a-e5d3-4d1f-9be3-0c608477e3a1}',\n '{f25e9f57-2fc8-4eb3-a41a-cce5f08541e6}','{fa445657-9379-11d6-b41a-00065b83ee53}'\n ) | ForEach-Object { [regex]::Escape($_) }) -join '|'\n $InboxPattern = 'TIP\\\\(?:' + $InboxIMEs + ')'\n $LanguageProfiles = Get-Item 'HKLM:\\SOFTWARE\\Microsoft\\CTF\\TIP\\{????????-????-????-????-????????????}\\LanguageProfile\\0x*\\{????????-????-????-????-????????????}' -EA SilentlyContinue\n foreach ($prof in @($LanguageProfiles)) {\n if ($prof.PSPath -match $InboxPattern) { continue }\n $pp = Get-ItemProperty $prof.PSPath -EA SilentlyContinue\n $hasEnable = ($pp.PSObject.Properties.Name -contains 'Enable')\n if ((-not $hasEnable) -or ($pp.Enable -eq 1)) {\n $Res = 1\n break\n }\n }\n Write-Host 'Final result:',$Res\n\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:41:55.835\t600\t\"Provider \"\"Alias\"\" is Started. \n\nDetails: \n\tProviderName=Alias\n\tNewProviderState=Started\n\n\tSequenceNumber=3\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=7246f244-6a24-4ffc-a54d-b05d2b9de908\n\tHostApplication=powershell.exe -ExecutionPolicy Restricted -Command \n $Res = 0\n $InboxIMEs = (@(\n '{0000897b-83df-4b96-be07-0fb58b01c4a4}','{03b5835f-f03c-411b-9ce2-aa23e1171e36}',\n '{531fdebf-9b4c-4a43-a2aa-960e8fcdc732}','{6a498709-e00b-4c45-a018-8f9e4081ae40}',\n '{7c472071-36a7-4709-88cc-859513e583a9}','{81d4e9c9-1d3b-41bc-9e6c-4b40bf79e35e}',\n '{81ea0a17-aa39-455b-ba20-ea79a8f98966}','{8613e14c-d0c0-4161-ac0f-1dd2563286bc}',\n '{a028ae76-01b1-46c2-99c4-acd9858ae02f}','{a1e2b86b-924a-4d43-80f6-8a820df7190f}',\n '{b115690a-ea02-48d5-a231-e3578d2fdf80}','{c2cb2cf0-af47-413e-9780-8bc3a3c16068}',\n '{dcbd6fa8-032f-11d3-b5b1-00c04fc324a1}','{e429b25a-e5d3-4d1f-9be3-0c608477e3a1}',\n '{f25e9f57-2fc8-4eb3-a41a-cce5f08541e6}','{fa445657-9379-11d6-b41a-00065b83ee53}'\n ) | ForEach-Object { [regex]::Escape($_) }) -join '|'\n $InboxPattern = 'TIP\\\\(?:' + $InboxIMEs + ')'\n $LanguageProfiles = Get-Item 'HKLM:\\SOFTWARE\\Microsoft\\CTF\\TIP\\{????????-????-????-????-????????????}\\LanguageProfile\\0x*\\{????????-????-????-????-????????????}' -EA SilentlyContinue\n foreach ($prof in @($LanguageProfiles)) {\n if ($prof.PSPath -match $InboxPattern) { continue }\n $pp = Get-ItemProperty $prof.PSPath -EA SilentlyContinue\n $hasEnable = ($pp.PSObject.Properties.Name -contains 'Enable')\n if ((-not $hasEnable) -or ($pp.Enable -eq 1)) {\n $Res = 1\n break\n }\n }\n Write-Host 'Final result:',$Res\n\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:41:55.835\t600\t\"Provider \"\"Environment\"\" is Started. \n\nDetails: \n\tProviderName=Environment\n\tNewProviderState=Started\n\n\tSequenceNumber=5\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=7246f244-6a24-4ffc-a54d-b05d2b9de908\n\tHostApplication=powershell.exe -ExecutionPolicy Restricted -Command \n $Res = 0\n $InboxIMEs = (@(\n '{0000897b-83df-4b96-be07-0fb58b01c4a4}','{03b5835f-f03c-411b-9ce2-aa23e1171e36}',\n '{531fdebf-9b4c-4a43-a2aa-960e8fcdc732}','{6a498709-e00b-4c45-a018-8f9e4081ae40}',\n '{7c472071-36a7-4709-88cc-859513e583a9}','{81d4e9c9-1d3b-41bc-9e6c-4b40bf79e35e}',\n '{81ea0a17-aa39-455b-ba20-ea79a8f98966}','{8613e14c-d0c0-4161-ac0f-1dd2563286bc}',\n '{a028ae76-01b1-46c2-99c4-acd9858ae02f}','{a1e2b86b-924a-4d43-80f6-8a820df7190f}',\n '{b115690a-ea02-48d5-a231-e3578d2fdf80}','{c2cb2cf0-af47-413e-9780-8bc3a3c16068}',\n '{dcbd6fa8-032f-11d3-b5b1-00c04fc324a1}','{e429b25a-e5d3-4d1f-9be3-0c608477e3a1}',\n '{f25e9f57-2fc8-4eb3-a41a-cce5f08541e6}','{fa445657-9379-11d6-b41a-00065b83ee53}'\n ) | ForEach-Object { [regex]::Escape($_) }) -join '|'\n $InboxPattern = 'TIP\\\\(?:' + $InboxIMEs + ')'\n $LanguageProfiles = Get-Item 'HKLM:\\SOFTWARE\\Microsoft\\CTF\\TIP\\{????????-????-????-????-????????????}\\LanguageProfile\\0x*\\{????????-????-????-????-????????????}' -EA SilentlyContinue\n foreach ($prof in @($LanguageProfiles)) {\n if ($prof.PSPath -match $InboxPattern) { continue }\n $pp = Get-ItemProperty $prof.PSPath -EA SilentlyContinue\n $hasEnable = ($pp.PSObject.Properties.Name -contains 'Enable')\n if ((-not $hasEnable) -or ($pp.Enable -eq 1)) {\n $Res = 1\n break\n }\n }\n Write-Host 'Final result:',$Res\n\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:41:55.836\t600\t\"Provider \"\"FileSystem\"\" is Started. \n\nDetails: \n\tProviderName=FileSystem\n\tNewProviderState=Started\n\n\tSequenceNumber=7\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=7246f244-6a24-4ffc-a54d-b05d2b9de908\n\tHostApplication=powershell.exe -ExecutionPolicy Restricted -Command \n $Res = 0\n $InboxIMEs = (@(\n '{0000897b-83df-4b96-be07-0fb58b01c4a4}','{03b5835f-f03c-411b-9ce2-aa23e1171e36}',\n '{531fdebf-9b4c-4a43-a2aa-960e8fcdc732}','{6a498709-e00b-4c45-a018-8f9e4081ae40}',\n '{7c472071-36a7-4709-88cc-859513e583a9}','{81d4e9c9-1d3b-41bc-9e6c-4b40bf79e35e}',\n '{81ea0a17-aa39-455b-ba20-ea79a8f98966}','{8613e14c-d0c0-4161-ac0f-1dd2563286bc}',\n '{a028ae76-01b1-46c2-99c4-acd9858ae02f}','{a1e2b86b-924a-4d43-80f6-8a820df7190f}',\n '{b115690a-ea02-48d5-a231-e3578d2fdf80}','{c2cb2cf0-af47-413e-9780-8bc3a3c16068}',\n '{dcbd6fa8-032f-11d3-b5b1-00c04fc324a1}','{e429b25a-e5d3-4d1f-9be3-0c608477e3a1}',\n '{f25e9f57-2fc8-4eb3-a41a-cce5f08541e6}','{fa445657-9379-11d6-b41a-00065b83ee53}'\n ) | ForEach-Object { [regex]::Escape($_) }) -join '|'\n $InboxPattern = 'TIP\\\\(?:' + $InboxIMEs + ')'\n $LanguageProfiles = Get-Item 'HKLM:\\SOFTWARE\\Microsoft\\CTF\\TIP\\{????????-????-????-????-????????????}\\LanguageProfile\\0x*\\{????????-????-????-????-????????????}' -EA SilentlyContinue\n foreach ($prof in @($LanguageProfiles)) {\n if ($prof.PSPath -match $InboxPattern) { continue }\n $pp = Get-ItemProperty $prof.PSPath -EA SilentlyContinue\n $hasEnable = ($pp.PSObject.Properties.Name -contains 'Enable')\n if ((-not $hasEnable) -or ($pp.Enable -eq 1)) {\n $Res = 1\n break\n }\n }\n Write-Host 'Final result:',$Res\n\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:41:55.836\t600\t\"Provider \"\"Function\"\" is Started. \n\nDetails: \n\tProviderName=Function\n\tNewProviderState=Started\n\n\tSequenceNumber=9\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=7246f244-6a24-4ffc-a54d-b05d2b9de908\n\tHostApplication=powershell.exe -ExecutionPolicy Restricted -Command \n $Res = 0\n $InboxIMEs = (@(\n '{0000897b-83df-4b96-be07-0fb58b01c4a4}','{03b5835f-f03c-411b-9ce2-aa23e1171e36}',\n '{531fdebf-9b4c-4a43-a2aa-960e8fcdc732}','{6a498709-e00b-4c45-a018-8f9e4081ae40}',\n '{7c472071-36a7-4709-88cc-859513e583a9}','{81d4e9c9-1d3b-41bc-9e6c-4b40bf79e35e}',\n '{81ea0a17-aa39-455b-ba20-ea79a8f98966}','{8613e14c-d0c0-4161-ac0f-1dd2563286bc}',\n '{a028ae76-01b1-46c2-99c4-acd9858ae02f}','{a1e2b86b-924a-4d43-80f6-8a820df7190f}',\n '{b115690a-ea02-48d5-a231-e3578d2fdf80}','{c2cb2cf0-af47-413e-9780-8bc3a3c16068}',\n '{dcbd6fa8-032f-11d3-b5b1-00c04fc324a1}','{e429b25a-e5d3-4d1f-9be3-0c608477e3a1}',\n '{f25e9f57-2fc8-4eb3-a41a-cce5f08541e6}','{fa445657-9379-11d6-b41a-00065b83ee53}'\n ) | ForEach-Object { [regex]::Escape($_) }) -join '|'\n $InboxPattern = 'TIP\\\\(?:' + $InboxIMEs + ')'\n $LanguageProfiles = Get-Item 'HKLM:\\SOFTWARE\\Microsoft\\CTF\\TIP\\{????????-????-????-????-????????????}\\LanguageProfile\\0x*\\{????????-????-????-????-????????????}' -EA SilentlyContinue\n foreach ($prof in @($LanguageProfiles)) {\n if ($prof.PSPath -match $InboxPattern) { continue }\n $pp = Get-ItemProperty $prof.PSPath -EA SilentlyContinue\n $hasEnable = ($pp.PSObject.Properties.Name -contains 'Enable')\n if ((-not $hasEnable) -or ($pp.Enable -eq 1)) {\n $Res = 1\n break\n }\n }\n Write-Host 'Final result:',$Res\n\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:41:55.836\t600\t\"Provider \"\"Variable\"\" is Started. \n\nDetails: \n\tProviderName=Variable\n\tNewProviderState=Started\n\n\tSequenceNumber=11\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=7246f244-6a24-4ffc-a54d-b05d2b9de908\n\tHostApplication=powershell.exe -ExecutionPolicy Restricted -Command \n $Res = 0\n $InboxIMEs = (@(\n '{0000897b-83df-4b96-be07-0fb58b01c4a4}','{03b5835f-f03c-411b-9ce2-aa23e1171e36}',\n '{531fdebf-9b4c-4a43-a2aa-960e8fcdc732}','{6a498709-e00b-4c45-a018-8f9e4081ae40}',\n '{7c472071-36a7-4709-88cc-859513e583a9}','{81d4e9c9-1d3b-41bc-9e6c-4b40bf79e35e}',\n '{81ea0a17-aa39-455b-ba20-ea79a8f98966}','{8613e14c-d0c0-4161-ac0f-1dd2563286bc}',\n '{a028ae76-01b1-46c2-99c4-acd9858ae02f}','{a1e2b86b-924a-4d43-80f6-8a820df7190f}',\n '{b115690a-ea02-48d5-a231-e3578d2fdf80}','{c2cb2cf0-af47-413e-9780-8bc3a3c16068}',\n '{dcbd6fa8-032f-11d3-b5b1-00c04fc324a1}','{e429b25a-e5d3-4d1f-9be3-0c608477e3a1}',\n '{f25e9f57-2fc8-4eb3-a41a-cce5f08541e6}','{fa445657-9379-11d6-b41a-00065b83ee53}'\n ) | ForEach-Object { [regex]::Escape($_) }) -join '|'\n $InboxPattern = 'TIP\\\\(?:' + $InboxIMEs + ')'\n $LanguageProfiles = Get-Item 'HKLM:\\SOFTWARE\\Microsoft\\CTF\\TIP\\{????????-????-????-????-????????????}\\LanguageProfile\\0x*\\{????????-????-????-????-????????????}' -EA SilentlyContinue\n foreach ($prof in @($LanguageProfiles)) {\n if ($prof.PSPath -match $InboxPattern) { continue }\n $pp = Get-ItemProperty $prof.PSPath -EA SilentlyContinue\n $hasEnable = ($pp.PSObject.Properties.Name -contains 'Enable')\n if ((-not $hasEnable) -or ($pp.Enable -eq 1)) {\n $Res = 1\n break\n }\n }\n Write-Host 'Final result:',$Res\n\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:41:55.839\t400\t\"Engine state is changed from None to Available. \n\nDetails: \n\tNewEngineState=Available\n\tPreviousEngineState=None\n\n\tSequenceNumber=13\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=7246f244-6a24-4ffc-a54d-b05d2b9de908\n\tHostApplication=powershell.exe -ExecutionPolicy Restricted -Command \n $Res = 0\n $InboxIMEs = (@(\n '{0000897b-83df-4b96-be07-0fb58b01c4a4}','{03b5835f-f03c-411b-9ce2-aa23e1171e36}',\n '{531fdebf-9b4c-4a43-a2aa-960e8fcdc732}','{6a498709-e00b-4c45-a018-8f9e4081ae40}',\n '{7c472071-36a7-4709-88cc-859513e583a9}','{81d4e9c9-1d3b-41bc-9e6c-4b40bf79e35e}',\n '{81ea0a17-aa39-455b-ba20-ea79a8f98966}','{8613e14c-d0c0-4161-ac0f-1dd2563286bc}',\n '{a028ae76-01b1-46c2-99c4-acd9858ae02f}','{a1e2b86b-924a-4d43-80f6-8a820df7190f}',\n '{b115690a-ea02-48d5-a231-e3578d2fdf80}','{c2cb2cf0-af47-413e-9780-8bc3a3c16068}',\n '{dcbd6fa8-032f-11d3-b5b1-00c04fc324a1}','{e429b25a-e5d3-4d1f-9be3-0c608477e3a1}',\n '{f25e9f57-2fc8-4eb3-a41a-cce5f08541e6}','{fa445657-9379-11d6-b41a-00065b83ee53}'\n ) | ForEach-Object { [regex]::Escape($_) }) -join '|'\n $InboxPattern = 'TIP\\\\(?:' + $InboxIMEs + ')'\n $LanguageProfiles = Get-Item 'HKLM:\\SOFTWARE\\Microsoft\\CTF\\TIP\\{????????-????-????-????-????????????}\\LanguageProfile\\0x*\\{????????-????-????-????-????????????}' -EA SilentlyContinue\n foreach ($prof in @($LanguageProfiles)) {\n if ($prof.PSPath -match $InboxPattern) { continue }\n $pp = Get-ItemProperty $prof.PSPath -EA SilentlyContinue\n $hasEnable = ($pp.PSObject.Properties.Name -contains 'Enable')\n if ((-not $hasEnable) -or ($pp.Enable -eq 1)) {\n $Res = 1\n break\n }\n }\n Write-Host 'Final result:',$Res\n\n\tEngineVersion=5.1.26100.9168\n\tRunspaceId=ac67b62f-e408-4136-9555-68557a15cd34\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:41:55.840\t40962\tPowerShell console is ready for user input\tInformation\tMicrosoft-Windows-PowerShell/Operational\tMicrosoft-Windows-PowerShell\n05.09.2026 08:41:55.860\t4104\t\"Creating Scriptblock text (1 of 1):\n\n $Res = 0\n $InboxIMEs = (@(\n '{0000897b-83df-4b96-be07-0fb58b01c4a4}','{03b5835f-f03c-411b-9ce2-aa23e1171e36}',\n '{531fdebf-9b4c-4a43-a2aa-960e8fcdc732}','{6a498709-e00b-4c45-a018-8f9e4081ae40}',\n '{7c472071-36a7-4709-88cc-859513e583a9}','{81d4e9c9-1d3b-41bc-9e6c-4b40bf79e35e}',\n '{81ea0a17-aa39-455b-ba20-ea79a8f98966}','{8613e14c-d0c0-4161-ac0f-1dd2563286bc}',\n '{a028ae76-01b1-46c2-99c4-acd9858ae02f}','{a1e2b86b-924a-4d43-80f6-8a820df7190f}',\n '{b115690a-ea02-48d5-a231-e3578d2fdf80}','{c2cb2cf0-af47-413e-9780-8bc3a3c16068}',\n '{dcbd6fa8-032f-11d3-b5b1-00c04fc324a1}','{e429b25a-e5d3-4d1f-9be3-0c608477e3a1}',\n '{f25e9f57-2fc8-4eb3-a41a-cce5f08541e6}','{fa445657-9379-11d6-b41a-00065b83ee53}'\n ) | ForEach-Object { [regex]::Escape($_) }) -join '|'\n $InboxPattern = 'TIP\\\\(?:' + $InboxIMEs + ')'\n $LanguageProfiles = Get-Item 'HKLM:\\SOFTWARE\\Microsoft\\CTF\\TIP\\{????????-????-????-????-????????????}\\LanguageProfile\\0x*\\{????????-????-????-????-????????????}' -EA SilentlyContinue\n foreach ($prof in @($LanguageProfiles)) {\n if ($prof.PSPath -match $InboxPattern) { continue }\n $pp = Get-ItemProperty $prof.PSPath -EA SilentlyContinue\n $hasEnable = ($pp.PSObject.Properties.Name -contains 'Enable')\n if ((-not $hasEnable) -or ($pp.Enable -eq 1)) {\n $Res = 1\n break\n }\n }\n Write-Host 'Final result:',$Res\n\n\nScriptBlock ID: d9a558dc-25c3-4fd1-9495-6a9ab2df4590\nPath: \"\tWarning\tMicrosoft-Windows-PowerShell/Operational\tMicrosoft-Windows-PowerShell\n05.09.2026 08:41:56.319\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:56.401\t403\t\"Engine state is changed from Available to Stopped. \n\nDetails: \n\tNewEngineState=Stopped\n\tPreviousEngineState=Available\n\n\tSequenceNumber=33\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=7246f244-6a24-4ffc-a54d-b05d2b9de908\n\tHostApplication=powershell.exe -ExecutionPolicy Restricted -Command \n $Res = 0\n $InboxIMEs = (@(\n '{0000897b-83df-4b96-be07-0fb58b01c4a4}','{03b5835f-f03c-411b-9ce2-aa23e1171e36}',\n '{531fdebf-9b4c-4a43-a2aa-960e8fcdc732}','{6a498709-e00b-4c45-a018-8f9e4081ae40}',\n '{7c472071-36a7-4709-88cc-859513e583a9}','{81d4e9c9-1d3b-41bc-9e6c-4b40bf79e35e}',\n '{81ea0a17-aa39-455b-ba20-ea79a8f98966}','{8613e14c-d0c0-4161-ac0f-1dd2563286bc}',\n '{a028ae76-01b1-46c2-99c4-acd9858ae02f}','{a1e2b86b-924a-4d43-80f6-8a820df7190f}',\n '{b115690a-ea02-48d5-a231-e3578d2fdf80}','{c2cb2cf0-af47-413e-9780-8bc3a3c16068}',\n '{dcbd6fa8-032f-11d3-b5b1-00c04fc324a1}','{e429b25a-e5d3-4d1f-9be3-0c608477e3a1}',\n '{f25e9f57-2fc8-4eb3-a41a-cce5f08541e6}','{fa445657-9379-11d6-b41a-00065b83ee53}'\n ) | ForEach-Object { [regex]::Escape($_) }) -join '|'\n $InboxPattern = 'TIP\\\\(?:' + $InboxIMEs + ')'\n $LanguageProfiles = Get-Item 'HKLM:\\SOFTWARE\\Microsoft\\CTF\\TIP\\{????????-????-????-????-????????????}\\LanguageProfile\\0x*\\{????????-????-????-????-????????????}' -EA SilentlyContinue\n foreach ($prof in @($LanguageProfiles)) {\n if ($prof.PSPath -match $InboxPattern) { continue }\n $pp = Get-ItemProperty $prof.PSPath -EA SilentlyContinue\n $hasEnable = ($pp.PSObject.Properties.Name -contains 'Enable')\n if ((-not $hasEnable) -or ($pp.Enable -eq 1)) {\n $Res = 1\n break\n }\n }\n Write-Host 'Final result:',$Res\n\n\tEngineVersion=5.1.26100.9168\n\tRunspaceId=ac67b62f-e408-4136-9555-68557a15cd34\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:41:56.590\t40961\tPowerShell console is starting up\tInformation\tMicrosoft-Windows-PowerShell/Operational\tMicrosoft-Windows-PowerShell\n05.09.2026 08:41:56.626\t53504\tWindows PowerShell has started an IPC listening thread on process: 17516 in AppDomain: DefaultAppDomain.\tInformation\tMicrosoft-Windows-PowerShell/Operational\tMicrosoft-Windows-PowerShell\n05.09.2026 08:41:56.642\t600\t\"Provider \"\"Registry\"\" is Started. \n\nDetails: \n\tProviderName=Registry\n\tNewProviderState=Started\n\n\tSequenceNumber=1\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=af768790-f801-49c5-8c89-231d6ded434c\n\tHostApplication=powershell.exe -ExecutionPolicy Restricted -Command Write-Host 'Final result: 1';\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:41:56.643\t600\t\"Provider \"\"Alias\"\" is Started. \n\nDetails: \n\tProviderName=Alias\n\tNewProviderState=Started\n\n\tSequenceNumber=3\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=af768790-f801-49c5-8c89-231d6ded434c\n\tHostApplication=powershell.exe -ExecutionPolicy Restricted -Command Write-Host 'Final result: 1';\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:41:56.643\t600\t\"Provider \"\"Environment\"\" is Started. \n\nDetails: \n\tProviderName=Environment\n\tNewProviderState=Started\n\n\tSequenceNumber=5\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=af768790-f801-49c5-8c89-231d6ded434c\n\tHostApplication=powershell.exe -ExecutionPolicy Restricted -Command Write-Host 'Final result: 1';\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:41:56.644\t600\t\"Provider \"\"FileSystem\"\" is Started. \n\nDetails: \n\tProviderName=FileSystem\n\tNewProviderState=Started\n\n\tSequenceNumber=7\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=af768790-f801-49c5-8c89-231d6ded434c\n\tHostApplication=powershell.exe -ExecutionPolicy Restricted -Command Write-Host 'Final result: 1';\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:41:56.644\t600\t\"Provider \"\"Function\"\" is Started. \n\nDetails: \n\tProviderName=Function\n\tNewProviderState=Started\n\n\tSequenceNumber=9\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=af768790-f801-49c5-8c89-231d6ded434c\n\tHostApplication=powershell.exe -ExecutionPolicy Restricted -Command Write-Host 'Final result: 1';\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:41:56.644\t600\t\"Provider \"\"Variable\"\" is Started. \n\nDetails: \n\tProviderName=Variable\n\tNewProviderState=Started\n\n\tSequenceNumber=11\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=af768790-f801-49c5-8c89-231d6ded434c\n\tHostApplication=powershell.exe -ExecutionPolicy Restricted -Command Write-Host 'Final result: 1';\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:41:56.648\t400\t\"Engine state is changed from None to Available. \n\nDetails: \n\tNewEngineState=Available\n\tPreviousEngineState=None\n\n\tSequenceNumber=13\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=af768790-f801-49c5-8c89-231d6ded434c\n\tHostApplication=powershell.exe -ExecutionPolicy Restricted -Command Write-Host 'Final result: 1';\n\tEngineVersion=5.1.26100.9168\n\tRunspaceId=21e6fcd7-50d5-40ae-ae98-e6e90485c35d\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:41:56.648\t40962\tPowerShell console is ready for user input\tInformation\tMicrosoft-Windows-PowerShell/Operational\tMicrosoft-Windows-PowerShell\n05.09.2026 08:41:56.734\t403\t\"Engine state is changed from Available to Stopped. \n\nDetails: \n\tNewEngineState=Stopped\n\tPreviousEngineState=Available\n\n\tSequenceNumber=27\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=af768790-f801-49c5-8c89-231d6ded434c\n\tHostApplication=powershell.exe -ExecutionPolicy Restricted -Command Write-Host 'Final result: 1';\n\tEngineVersion=5.1.26100.9168\n\tRunspaceId=21e6fcd7-50d5-40ae-ae98-e6e90485c35d\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:41:56.901\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:57.766\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:57.989\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:58.213\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:59.992\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:02.328\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:03.217\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:09.657\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:11.755\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:17.651\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:19.542\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:20.101\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:21.101\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:22.436\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:24.844\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, DeliveryOptimizationMIProv, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:42:25.335\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:25.787\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:26.454\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:26.678\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:27.014\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:29.020\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:30.023\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:30.357\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:32.136\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:33.791\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:39.316\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:39.648\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:40.870\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:41.094\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:41.430\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:41.766\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:42.767\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:42.990\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:43.990\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:44.775\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:44.935\t3056\tTile Notification are being cleared for MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets - informed session 3.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:42:44.998\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:45.222\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:46.007\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:46.230\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:46.679\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:47.475\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:50.137\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:50.355\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:50.803\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:51.474\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:52.476\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:53.148\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:53.923\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:54.258\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:54.850\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, Win32_WIN32_TERMINALSERVICE_Prov, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:43:04.461\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.462\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-503\n\tAccount Name:\t\tDefaultAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.462\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-504\n\tAccount Name:\t\tWDAGUtilityAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.462\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1009\n\tAccount Name:\t\tWsiAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.463\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-500\n\tAccount Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.463\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-501\n\tAccount Name:\t\t\u0413\u043e\u0441\u0442\u044c\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.464\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.464\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-503\n\tAccount Name:\t\tDefaultAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.465\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-504\n\tAccount Name:\t\tWDAGUtilityAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.466\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1009\n\tAccount Name:\t\tWsiAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.466\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-500\n\tAccount Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.467\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-501\n\tAccount Name:\t\t\u0413\u043e\u0441\u0442\u044c\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.473\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.473\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-503\n\tAccount Name:\t\tDefaultAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.474\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-504\n\tAccount Name:\t\tWDAGUtilityAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.474\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1009\n\tAccount Name:\t\tWsiAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.475\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-500\n\tAccount Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.475\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-501\n\tAccount Name:\t\t\u0413\u043e\u0441\u0442\u044c\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.476\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.477\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-503\n\tAccount Name:\t\tDefaultAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.477\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-504\n\tAccount Name:\t\tWDAGUtilityAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.478\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1009\n\tAccount Name:\t\tWsiAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.478\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-500\n\tAccount Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.479\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-501\n\tAccount Name:\t\t\u0413\u043e\u0441\u0442\u044c\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:10.715\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:43:10.717\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:43:10.717\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:43:10.728\t8001\t\"Invoking license manager because license/lease polling time up: PFN A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (361)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.728\t8001\t\"ServiceBeginAcquireLicenseImpl PsmKey:A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6+App, IsSystemUsage:1\nFunction: ServiceBeginAcquireLicenseImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2304)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.729\t8002\t\"Failure Message: hr: 0x800703f0\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2324)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.729\t8001\t\"Failure Message: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp(2324)\\LicenseManager.dll!00007FFBF486A702: (caller: 00007FFBF525134D) Exception(4) tid(3e7c) 800703F0 \u041f\u043e\u043f\u044b\u0442\u043a\u0430 \u0441\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u043d\u0435\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0439 \u0442\u043e\u043a\u0435\u043d.\n\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2348)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.729\t8001\t\"ServiceBeginAcquireLicenseImpl PsmKey:A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6+App, IsSystemUsage:1\nFunction: ServiceBeginAcquireLicenseImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2304)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.729\t8002\t\"Failure Message: hr: 0x800703f0\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2324)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.729\t8001\t\"Failure Message: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp(2324)\\LicenseManager.dll!00007FFBF486A702: (caller: 00007FFBF525134D) Exception(5) tid(3e7c) 800703F0 \u041f\u043e\u043f\u044b\u0442\u043a\u0430 \u0441\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u043d\u0435\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0439 \u0442\u043e\u043a\u0435\u043d.\n\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2348)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.730\t8001\t\"ServiceBeginAcquireLicenseImpl PsmKey:A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6+App, IsSystemUsage:1\nFunction: ServiceBeginAcquireLicenseImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2304)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.731\t8001\t\"Skipping license manager: PFN A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.735\t8001\t\"Licensing package A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6 (3)\nFunction: OneStoreApplicationLicenseManager::GetLicenseForInstalledPackage\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\onestoreapplicensemanager.cpp (120)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.736\t8001\t\"Licensing 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A (Active)\nFunction: LicenseManager::LicenseContentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\manager.cpp (88)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.736\t8001\t\"0000021F831D3820: Key Machine for content: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\nFunction: KeyMachine::KeyMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (95)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.736\t8011\t0x21f83133e68: 3380: RootMachine: Dispatch: Root:Connect => Root:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.736\t8011\t0x21f831d3840: 3380: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A: Dispatch: Key:Activate => Key:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.736\t8001\t\"0000021F831D3820: BeginLicense: Operation 3, CachedLeaseOK true, RequireServiceValidation false\nFunction: KeyMachine::DoBeginLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (819)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.736\t8012\t0x21f831d3840: 3380: Key:Initial Change: Key:NegotiatingUnleased => 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.760\t505\t\"Compatibility fix applied to C:\\WINDOWS\\system32\\backgroundTaskHost.exe.\nFix information: \u042f\u043d\u0434\u0435\u043a\u0441.\u041c\u0443\u0437\u0438\u043a\u0430, {071f875e-406c-4938-beaa-65f69cc573e2}, 0x80010101.\"\tInformation\tMicrosoft-Windows-Application-Experience/Program-Telemetry\tMicrosoft-Windows-Application-Experience\n05.09.2026 08:43:10.765\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:10.765\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:10.793\t100\tClipSVC service is starting.  Caller: TriggerStarted\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 08:43:10.794\t210\tCreated Desktop AppX container {245CDD4B-A8C9-11F1-B7FF-289200F24A99} for package MSTeams_26093.415.4620.1935_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:43:10.794\t211\tAdded process 11916 to Desktop AppX container 245cdd4b-a8c9-11f1-b7ff-289200f24a99 for package MSTeams_26093.415.4620.1935_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:43:10.796\t101\tClipSVC service is running.  Version 10.0.26100.9168\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 08:43:10.805\t8001\t\"Considering License ID {DE7849EA-B8E4-60D1-C780-7B0969A99E76} for content ID 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.805\t8001\t\"Decoding: {\"\"legacyProductId\"\":\"\"b7757af6-9e6d-4d21-8272-c9137a2e9145\"\"}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.805\t8001\t\"Accepting key with License ID {DE7849EA-B8E4-60D1-C780-7B0969A99E76} for Content ID 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A (first match)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (223)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.805\t8001\t\"Returning key document for contentid 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (262)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.806\t8001\t\"Getting lease for 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\nFunction: LicenseManagerCore::GetExistingLeaseAndLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (415)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.807\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2be1da80-9d39-1a56-8b4b-dca10f958cc2\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=80daf1f6-7afc-6d23-2c3c-f1e0a663029a&entitlementId=2be1da80-9d39-1a56-8b4b-dca10f958cc2&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"de7849ea-b8e4-60d1-c780-7b0969a99e76\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"80daf1f6-7afc-6d23-2c3c-f1e0a663029a\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NBLGGH0CB6D\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-09-04T15:27:12.2174791+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.807\t8001\t\"Adding lease {941FBCC0-EC32-D9CB-EB46-FC3AE38EC79B} to results\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (387)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.807\t8001\t\"Returning 1 lease documents for contentid 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.807\t8001\t\"lease = 0x831ac208, usage = 268435456, policy = 1, operation = 3, leaseBehavior = 0, shouldContentBeDeactivated = 0\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (905)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.807\t8011\t0x21f831d3840: 3380: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A: Dispatch: Key:@LicenseDone => Key:NegotiatingUnleased\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.813\t8001\t\"lease = 0x831ac208, leaseActive = 1, leaseBehavior = 0\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1986)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.813\t8001\t\"Lease Machine: 0000021F8312A600: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\nFunction: LeaseMachine::LeaseMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (40)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.813\t8001\t\"Set results for lease = 0x831ac208, policy = 1, operation = 3, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.813\t8001\t\"No cached lease or key found, not renewing with service and treating this as a valid license with lease = 0x831ac208\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (2032)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.813\t8012\t0x21f831d3840: 3380: Key:NegotiatingUnleased Change: Key:Valid => 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.813\t8011\t0x21f8312a620: 3380: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}: Dispatch: Lease:UpdateLeaseDocument => Lease:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.813\t8012\t0x21f8312a620: 3380: Lease:Initial Change: Lease:Valid => {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.813\t8001\t\"Decoding: {\"\"legacyProductId\"\":\"\"b7757af6-9e6d-4d21-8272-c9137a2e9145\"\"}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.813\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2be1da80-9d39-1a56-8b4b-dca10f958cc2\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=80daf1f6-7afc-6d23-2c3c-f1e0a663029a&entitlementId=2be1da80-9d39-1a56-8b4b-dca10f958cc2&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"de7849ea-b8e4-60d1-c780-7b0969a99e76\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"80daf1f6-7afc-6d23-2c3c-f1e0a663029a\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NBLGGH0CB6D\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-09-04T15:27:12.2174791+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.813\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2be1da80-9d39-1a56-8b4b-dca10f958cc2\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=80daf1f6-7afc-6d23-2c3c-f1e0a663029a&entitlementId=2be1da80-9d39-1a56-8b4b-dca10f958cc2&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"de7849ea-b8e4-60d1-c780-7b0969a99e76\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"80daf1f6-7afc-6d23-2c3c-f1e0a663029a\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NBLGGH0CB6D\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-09-04T15:27:12.2174791+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.813\t8001\t\"Updating lease timer for {1173A7B1-89F2-09CC-0563-CDED7D7397B9} to expire @ 2026-09-05T02:01:48Z (jitter was 18.636007 minutes)\nFunction: LeaseMachine::DoUpdateLeaseTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (276)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.813\t8001\t\"Added timer for {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\nFunction: MemoryTimerService::CreateTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (57)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.813\t8011\t0x21f8312a620: 3380: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}: Dispatch: Lease:AddKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.813\t8011\t0x21f831d3840: 3380: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A: Dispatch: Key:RegisterCallback => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.813\t8001\t\"ReactiveLicensingResult: 0x00000000 for A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6, 79ms\nFunction: LogReactiveLicensingResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\telemetry.cpp (512)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.814\t8001\t\"Licensing package Microsoft.YourPhone_1.26071.164.0_x64__8wekyb3d8bbwe (3)\nFunction: OneStoreApplicationLicenseManager::GetLicenseForInstalledPackage\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\onestoreapplicensemanager.cpp (120)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.815\t8001\t\"Licensing EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED (Active)\nFunction: LicenseManager::LicenseContentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\manager.cpp (88)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.815\t8001\t\"0000021F831D3050: Key Machine for content: EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED\nFunction: KeyMachine::KeyMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (95)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.815\t8011\t0x21f83133e68: 19344: RootMachine: Dispatch: Root:Connect => Root:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.815\t8011\t0x21f831d3070: 15996: EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED: Dispatch: Key:Activate => Key:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.815\t8001\t\"0000021F831D3050: BeginLicense: Operation 3, CachedLeaseOK true, RequireServiceValidation false\nFunction: KeyMachine::DoBeginLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (819)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.815\t8012\t0x21f831d3070: 15996: Key:Initial Change: Key:NegotiatingUnleased => EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.816\t8001\t\"Considering License ID {0F8E2CD5-B8EB-7A22-B9E9-9B1183FA0A84} for content ID EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.817\t8001\t\"Decoding: {\"\"legacyProductId\"\":\"\"6ead4a77-d076-4866-9188-621a5b1f414f\"\"}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.817\t8001\t\"Accepting key with License ID {0F8E2CD5-B8EB-7A22-B9E9-9B1183FA0A84} for Content ID EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED (first match)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (223)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.817\t8001\t\"Returning key document for contentid EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (262)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.817\t8001\t\"Getting lease for EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED\nFunction: LicenseManagerCore::GetExistingLeaseAndLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (415)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.819\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"200dc622-8cbd-e337-4d4b-69d2fa6e7df7\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966575679381420&contentId=eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed&entitlementId=200dc622-8cbd-e337-4d4b-69d2fa6e7df7&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"0f8e2cd5-b8eb-7a22-b9e9-9b1183fa0a84\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NMPJ99VJBWV\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-08-04T14:54:13.8630559+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.819\t8001\t\"Adding lease {A900C622-99E6-0D09-3F2B-FC30E2F4563B} to results\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (387)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.819\t8001\t\"Returning 1 lease documents for contentid EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.819\t8001\t\"lease = 0x831acdd8, usage = 536870912, policy = 2147483647, operation = 3, leaseBehavior = 0, shouldContentBeDeactivated = 0\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (905)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.819\t8001\t\"lease = 0x831acdd8, quality = 1073741824\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (935)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.819\t8001\t\"content is alreadyLicensed, lease is cached\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (942)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.819\t8011\t0x21f831d3070: 15996: EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED: Dispatch: Key:@LicenseDone => Key:NegotiatingUnleased\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.820\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 8552) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffbf5f37243, module offset: 0x17243, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x22298f5ea80, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:43:10.820\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 8552) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffbf5f2fda9, module offset: 0xfda9, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x22298f5c180, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:43:10.820\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 8552) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffbf5f390c3, module offset: 0x190c3, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x22298f5c189, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:43:10.820\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 8552) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffbf5f306ff, module offset: 0x106ff, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x22298f5c1a8, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:43:10.820\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 8552) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffbf5f289fd, module offset: 0x89fd, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x22298f5c1a0, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:43:10.825\t8001\t\"lease = 0x831acdd8, leaseActive = 1, leaseBehavior = 0\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1986)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.825\t8001\t\"Lease Machine: 0000021F8312A800: {7BA318A1-DC47-F731-723C-537E883DC563}\nFunction: LeaseMachine::LeaseMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (40)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.825\t8001\t\"Set results for lease = 0x831acdd8, policy = 2147483647, operation = 3, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.825\t8011\t0x21f8312a820: 18884: {7BA318A1-DC47-F731-723C-537E883DC563}: Dispatch: Lease:UpdateLeaseDocument => Lease:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.825\t8012\t0x21f8312a820: 18884: Lease:Initial Change: Lease:Valid => {7BA318A1-DC47-F731-723C-537E883DC563}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.825\t8001\t\"No cached lease or key found, not renewing with service and treating this as a valid license with lease = 0x831acdd8\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (2032)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.825\t8012\t0x21f831d3070: 15996: Key:NegotiatingUnleased Change: Key:Valid => EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.825\t8001\t\"Decoding: {\"\"legacyProductId\"\":\"\"6ead4a77-d076-4866-9188-621a5b1f414f\"\"}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.825\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"200dc622-8cbd-e337-4d4b-69d2fa6e7df7\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966575679381420&contentId=eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed&entitlementId=200dc622-8cbd-e337-4d4b-69d2fa6e7df7&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"0f8e2cd5-b8eb-7a22-b9e9-9b1183fa0a84\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NMPJ99VJBWV\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-08-04T14:54:13.8630559+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.825\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"200dc622-8cbd-e337-4d4b-69d2fa6e7df7\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966575679381420&contentId=eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed&entitlementId=200dc622-8cbd-e337-4d4b-69d2fa6e7df7&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"0f8e2cd5-b8eb-7a22-b9e9-9b1183fa0a84\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NMPJ99VJBWV\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-08-04T14:54:13.8630559+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.825\t8001\t\"Updating lease timer for {7BA318A1-DC47-F731-723C-537E883DC563} to expire @ 2026-09-05T02:26:48Z (jitter was 43.630096 minutes)\nFunction: LeaseMachine::DoUpdateLeaseTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (276)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.825\t8001\t\"Added timer for {7BA318A1-DC47-F731-723C-537E883DC563}\nFunction: MemoryTimerService::CreateTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (57)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.825\t8011\t0x21f8312a820: 18884: {7BA318A1-DC47-F731-723C-537E883DC563}: Dispatch: Lease:AddKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.825\t8011\t0x21f831d3070: 3380: EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED: Dispatch: Key:RegisterCallback => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.831\t8011\t0x21f831d3070: 3380: EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED: Dispatch: Key:Connect => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.831\t8001\t\"Decoding: {\"\"legacyProductId\"\":\"\"6ead4a77-d076-4866-9188-621a5b1f414f\"\"}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.831\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"200dc622-8cbd-e337-4d4b-69d2fa6e7df7\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966575679381420&contentId=eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed&entitlementId=200dc622-8cbd-e337-4d4b-69d2fa6e7df7&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"0f8e2cd5-b8eb-7a22-b9e9-9b1183fa0a84\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NMPJ99VJBWV\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-08-04T14:54:13.8630559+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.831\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"200dc622-8cbd-e337-4d4b-69d2fa6e7df7\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966575679381420&contentId=eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed&entitlementId=200dc622-8cbd-e337-4d4b-69d2fa6e7df7&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"0f8e2cd5-b8eb-7a22-b9e9-9b1183fa0a84\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NMPJ99VJBWV\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-08-04T14:54:13.8630559+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.961\t16394\tOffline downlevel migration succeeded.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 08:43:11.453\t157\tThe license with Id 2da6ca43-2e6f-1f16-05ad-a9959043ddb7 has been archived successfully.  PFM if available: Microsoft.Windows.99.X20-15863_8wekyb3d8bbwe\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 08:43:11.453\t116\t\"Application license successfully installed.\nPackage: Microsoft.Windows.99.X20-15863_8wekyb3d8bbwe\nUser Id (if available): NULL\nLicense Id: 2da6ca43-2e6f-1f16-05ad-a9959043ddb7\nAssociate Id: 2da6ca43-2e6f-1f16-05ad-a9959043ddb7\"\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 08:43:11.459\t8001\t\"Licensing content 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: OneStoreApplicationLicenseManager::ActivateLicenseForContent\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\onestoreapplicensemanager.cpp (410)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.459\t8001\t\"Licensing 807d73a3-33f2-c21b-c47a-85c313d97af9 (Active)\nFunction: LicenseManager::LicenseContentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\manager.cpp (88)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.459\t8002\t\"Capturing identity for LocalSystem, this probably isn't intended\nFunction: StoredIdentity::StoredIdentity\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\identity.cpp (536)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.459\t8001\t\"0000021F831F7E00: Key Machine for content: 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: KeyMachine::KeyMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (95)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.459\t8011\t0x21f83133e68: 15996: RootMachine: Dispatch: Root:Connect => Root:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.459\t8011\t0x21f831f7e20: 15996: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:Activate => Key:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.459\t8001\t\"0000021F831F7E00: BeginLicense: Operation 3, CachedLeaseOK true, RequireServiceValidation false\nFunction: KeyMachine::DoBeginLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (819)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.459\t8012\t0x21f831f7e20: 15996: Key:Initial Change: Key:NegotiatingUnleased => 807d73a3-33f2-c21b-c47a-85c313d97af9\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.461\t8001\t\"Considering License ID {2DA6CA43-2E6F-1F16-05AD-A9959043DDB7} for content ID 807d73a3-33f2-c21b-c47a-85c313d97af9...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.461\t8001\t\"Accepting key with License ID {2DA6CA43-2E6F-1F16-05AD-A9959043DDB7} for Content ID 807d73a3-33f2-c21b-c47a-85c313d97af9 (first match)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (223)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.461\t8001\t\"Considering License ID {8CB56148-398C-A7C4-98F2-6FDC89C2093D} for content ID 807d73a3-33f2-c21b-c47a-85c313d97af9...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.461\t8001\t\"Ignoring key for 807d73a3-33f2-c21b-c47a-85c313d97af9 with quality fffffff (0xc0ea0009) (no better than best)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (251)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.461\t8001\t\"Considering License ID {BDBB3CA5-594E-7337-A093-A9860F553465} for content ID 807d73a3-33f2-c21b-c47a-85c313d97af9...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.461\t8001\t\"Decoding: {}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.461\t8001\t\"Accepting key with License ID {BDBB3CA5-594E-7337-A093-A9860F553465} for Content ID 807d73a3-33f2-c21b-c47a-85c313d97af9 (better quality: 7f000000 vs 1fffffff)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (229)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.461\t8001\t\"Returning key document for contentid 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (262)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.461\t8001\t\"Getting lease for 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: LicenseManagerCore::GetExistingLeaseAndLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (415)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.463\t8001\t\"Ignoring otherwise matching lease ({33B013F2-4858-241D-9000-CA9374B3ADB5}) for Content ID 807D73A3-33F2-C21B-C47A-85C313D97AF9 because of quality 268435455 (0xc0ea000a)\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (396)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.463\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.463\t8001\t\"Adding lease {AE9143F3-8179-89B2-A3AF-FFC1D366D1AE} to results\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (387)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.463\t8001\t\"Returning 1 lease documents for contentid 807D73A3-33F2-C21B-C47A-85C313D97AF9\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.463\t8001\t\"lease = 0x831ac3b8, usage = 536870912, policy = 2147483647, operation = 3, leaseBehavior = 0, shouldContentBeDeactivated = 0\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (905)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.463\t8001\t\"lease = 0x831ac3b8, quality = 1073741824\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (935)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.463\t8001\t\"content is alreadyLicensed, lease is cached\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (942)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.463\t8011\t0x21f831f7e20: 15996: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:@LicenseDone => Key:NegotiatingUnleased\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8002\t\"Failure Message: hr: 0x80070490\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\misc.cpp (49)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8001\t\"lease = 0x831ac3b8, leaseActive = 1, leaseBehavior = 0\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1986)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8001\t\"Lease Machine: 0000021F8312B200: {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: LeaseMachine::LeaseMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (40)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8001\t\"Set results for lease = 0x831ac3b8, policy = 2147483647, operation = 3, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8011\t0x21f8312b220: 18884: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:UpdateLeaseDocument => Lease:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8012\t0x21f8312b220: 18884: Lease:Initial Change: Lease:Valid => {2CE050AC-4159-AABB-AC60-9CED070AF672}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8001\t\"No cached lease or key found, not renewing with service and treating this as a valid license with lease = 0x831ac3b8\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (2032)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8012\t0x21f831f7e20: 15996: Key:NegotiatingUnleased Change: Key:Valid => 807d73a3-33f2-c21b-c47a-85c313d97af9\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8001\t\"Decoding: {}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8011\t0x21f831f7e20: 3380: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:RegisterCallback => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8001\t\"Updating lease timer for {2CE050AC-4159-AABB-AC60-9CED070AF672} to expire @ 2026-09-11T13:58:38Z (jitter was 32.544819 minutes)\nFunction: LeaseMachine::DoUpdateLeaseTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (276)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8001\t\"Added timer for {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: MemoryTimerService::CreateTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (57)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8011\t0x21f8312b220: 18884: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:AddKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8011\t0x21f831f7e20: 18884: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:Unregistered => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8001\t\"Lease dropped\nFunction: KeyMachine::DoDropLease\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (279)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8012\t0x21f831f7e20: 18884: Key:Valid Change: Key:Invalid => 807d73a3-33f2-c21b-c47a-85c313d97af9\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8011\t0x21f8312b220: 15996: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:RemoveKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8011\t0x21f8312b220: 15996: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:Unregistered => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8001\t\"Set results for lease = 0x0, policy = 0, operation = 0, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8012\t0x21f8312b220: 15996: Lease:Valid Change: Lease:Invalid => {2CE050AC-4159-AABB-AC60-9CED070AF672}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8001\t\"Requesting lease document removal for reason 0x00000000, {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: LicenseManagerCore::DoRemoveLeaseDocumentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (1460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.466\t173\tProduct key from MSDM table redeemed. Result: 0x0\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 08:43:11.466\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.466\t8001\t\"Ignoring lease removal with reason 0x00000000 because this is an offline lease\n\nFunction: ClipStorage::RemoveLeaseDocumentWithIdAndReason\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (501)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.466\t8002\t\"Trying to remove timer {2CE050AC-4159-AABB-AC60-9CED070AF672} not in table\nFunction: MemoryTimerService::CancelTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (80)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.466\t8001\t\"Removed timer for {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: MemoryTimerService::CleanupTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (19)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:12.007\t217\tDestroyed Desktop AppX container {245CDD4B-A8C9-11F1-B7FF-289200F24A99} for package MSTeams_26093.415.4620.1935_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:43:19.502\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:43:19.502\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:43:19.523\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:43:19.523\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:43:19.885\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:43:28.288\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:43:28.288\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:43:28.288\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:43:28.302\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:43:31.954\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:43:32.291\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:43:35.473\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, Win32_DeviceGuard, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:43:41.192\t16384\tSuccessfully scheduled Software Protection service for re-start at 2126-08-12T01:43:41Z. Reason: RulesEngine.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 08:43:44.968\t3056\tTile Notification are being cleared for MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets - informed session 3.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:43:52.998\t158\t\"NTFS metadata statistics for volume:\n\n           Volume Id: {23606dfe-da07-4ad7-8798-8deaced0a66e}\n           Volume name: C:\n\n           UserFileReads: 144285\n           UserFileReadBytes: 7149538816\n           UserDiskReads: 145299\n           UserFileWrites: 39531\n           UserFileWriteBytes: 1401008128\n           UserDiskWrites: 47950\n\n           MetaDataReads: 45270\n           MetaDataReadBytes: 196149248\n           MetaDataDiskReads: 66993\n           MetaDataWrites: 24396\n           MetaDataWriteBytes: 200843264\n           MetaDataDiskWrites: 31243\n\n           MftReads: 43137\n           MftReadBytes: 176717824\n           MftWrites: 21593\n           MftWriteBytes: 171913216\n           Mft2Writes: 0\n           Mft2WriteBytes: 0\n           RootIndexReads: 0\n           RootIndexReadBytes: 0\n           RootIndexWrites: 0\n           RootIndexWriteBytes: 0\n           BitmapReads: 10\n           BitmapReadBytes: 9830400\n           BitmapWrites: 2685\n           BitmapWriteBytes: 23367680\n           MftBitmapReads: 4\n           MftBitmapReadBytes: 208896\n           MftBitmapWrites: 46\n           MftBitmapWriteBytes: 360448\n           UserIndexReads: 23287\n           UserIndexReadBytes: 102342656\n           UserIndexWrites: 7067\n           UserIndexWriteBytes: 46972928\n           LogFileReads: 8\n           LogFileReadBytes: 32768\n           LogFileWrites: 18653\n           LogFileWriteBytes: 232017920\n           LogFileFull: 1\n           LogFileFullReasons:\n                     LF_LOG_SPACE: 0\n                     LF_DIRTY_PAGES: 0\n                     LF_OPEN_ATTRIBUTES: 1\n                     LF_TRANSACTION_DRAIN: 0\n                     LF_FASTIO_CALLBACK: 0\n                     LF_DEALLOCATED_CLUSTERS: 0\n                     LF_DEALLOCATED_CLUSTERS_MEM: 0\n                     LF_RECORD_STACK_CHECK: 0\n                     LF_DISMOUNT: 0\n                     LF_COMPRESSION: 0\n                     LF_SNAPSHOT: 0\n                     LF_MOUNT: 0\n                     LF_SHUTDOWN: 0\n                     LF_RECURSIVE_COMPRESSION: 0\n                     LF_TESTING: 0\n\n           DiskResourceFailure: 0\n           VolumeTrimCount: 462\n                     VolumeTrimTime (ms): 3424\n                     VolumeTrimSize (KB): 10246628\n                     AvgVolumeTrimTime (ms): 7\n                     AvgVolumeTrimSize (KB): 22178\n           VolumeTrimSkippedCount: 0\n                     VolumeTrimSkippedSize (KB): 0\n           FileLevelTrimCount: 2\n                     FileLevelTrimTime (ms): 42\n                     FileLevelTrimSize (KB): 19737276\n                     AvgFileLevelTrimTime (ms): 21\n                     AvgFileLevelTrimSize (KB): 9868638\n           NtfsFillStatInfoFromMftRecordCalledCount: 5488\n           NtfsFillStatInfoFromMftRecordBailedBecauseOfAttributeListCount: 0\n           NtfsFillStatInfoFromMftRecordBailedBecauseOfNonResReparsePointCount: 0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:43:52.998\t171\t\"File-Level Trim Summary:\n\n           Volume Id: {23606dfe-da07-4ad7-8798-8deaced0a66e}\n           Volume name: C:\n           Is boot volume: true\n           \n           Period duration (us): 903808373\n           \n           Operation count: 4\n           Reposted operation count: 0\n           Failed operation count: 0\n           Operation range count: 4\n           Operation byte count: 0\n           Operation long range byte count 18446744073709547516\n           Unaligned range count: 0\n           Bytes in unaligned ranges: 0\n           Operation trim extent count: 6\n           Non-blocking aligned trim byte count: 0\n           Reclaimed byte count: 32575778816\n           \n           Byte count bucket values: [4 KB, 64 KB, 1 MB, 16 MB, 128 MB, 1 GB, 16 GB, 128 GB, 1 TB, 16 TB, 1 EB, 1+ EB]\n           \n           Operation counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 4]\n           Operation byte counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n           Operation bytes reclaimed: [0, 0, 0, 0, 23, 0, 62263, 0, 0, 0, 0, 0]\n           Operation latency (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 79]\n           \n           Latency bucket values: [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2s, 6s, 10s, 20s, 1m, 5m, 15m, 15m+]\n           \n           Operation latency count: [1, 0, 0, 0, 3, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n           \n           Top failure status codes and instance counts:\n               0x0      0\n               0x0      0\n               0x0      0\n               0x0      0\n               0x0      0\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:43:53.001\t158\t\"NTFS metadata statistics for volume:\n\n           Volume Id: {b4de30fc-d998-46fa-9187-a8f915fd81fc}\n           Volume name: D:\n\n           UserFileReads: 3\n           UserFileReadBytes: 12288\n           UserDiskReads: 1\n           UserFileWrites: 0\n           UserFileWriteBytes: 0\n           UserDiskWrites: 0\n\n           MetaDataReads: 45\n           MetaDataReadBytes: 20856832\n           MetaDataDiskReads: 49\n           MetaDataWrites: 8\n           MetaDataWriteBytes: 49152\n           MetaDataDiskWrites: 12\n\n           MftReads: 11\n           MftReadBytes: 73728\n           MftWrites: 7\n           MftWriteBytes: 45056\n           Mft2Writes: 0\n           Mft2WriteBytes: 0\n           RootIndexReads: 0\n           RootIndexReadBytes: 0\n           RootIndexWrites: 0\n           RootIndexWriteBytes: 0\n           BitmapReads: 20\n           BitmapReadBytes: 20537344\n           BitmapWrites: 0\n           BitmapWriteBytes: 0\n           MftBitmapReads: 1\n           MftBitmapReadBytes: 8192\n           MftBitmapWrites: 0\n           MftBitmapWriteBytes: 0\n           UserIndexReads: 3\n           UserIndexReadBytes: 12288\n           UserIndexWrites: 4\n           UserIndexWriteBytes: 16384\n           LogFileReads: 8\n           LogFileReadBytes: 32768\n           LogFileWrites: 27\n           LogFileWriteBytes: 114688\n           LogFileFull: 0\n           LogFileFullReasons:\n                     LF_LOG_SPACE: 0\n                     LF_DIRTY_PAGES: 0\n                     LF_OPEN_ATTRIBUTES: 0\n                     LF_TRANSACTION_DRAIN: 0\n                     LF_FASTIO_CALLBACK: 0\n                     LF_DEALLOCATED_CLUSTERS: 0\n                     LF_DEALLOCATED_CLUSTERS_MEM: 0\n                     LF_RECORD_STACK_CHECK: 0\n                     LF_DISMOUNT: 0\n                     LF_COMPRESSION: 0\n                     LF_SNAPSHOT: 0\n                     LF_MOUNT: 0\n                     LF_SHUTDOWN: 0\n                     LF_RECURSIVE_COMPRESSION: 0\n                     LF_TESTING: 0\n\n           DiskResourceFailure: 0\n           VolumeTrimCount: 0\n                     VolumeTrimTime (ms): 0\n                     VolumeTrimSize (KB): 0\n                     AvgVolumeTrimTime (ms): 0\n                     AvgVolumeTrimSize (KB): 0\n           VolumeTrimSkippedCount: 0\n                     VolumeTrimSkippedSize (KB): 0\n           FileLevelTrimCount: 0\n                     FileLevelTrimTime (ms): 0\n                     FileLevelTrimSize (KB): 0\n                     AvgFileLevelTrimTime (ms): 0\n                     AvgFileLevelTrimSize (KB): 0\n           NtfsFillStatInfoFromMftRecordCalledCount: 0\n           NtfsFillStatInfoFromMftRecordBailedBecauseOfAttributeListCount: 0\n           NtfsFillStatInfoFromMftRecordBailedBecauseOfNonResReparsePointCount: 0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:43:53.001\t158\t\"NTFS metadata statistics for volume:\n\n           Volume Id: {580f6681-a25f-4cec-9096-3d65cabf1f4a}\n           Volume name: \\\\?\\Volume{580f6681-a25f-4cec-9096-3d65cabf1f4a}\n\n           UserFileReads: 5\n           UserFileReadBytes: 20480\n           UserDiskReads: 5\n           UserFileWrites: 0\n           UserFileWriteBytes: 0\n           UserDiskWrites: 0\n\n           MetaDataReads: 14\n           MetaDataReadBytes: 245760\n           MetaDataDiskReads: 16\n           MetaDataWrites: 4\n           MetaDataWriteBytes: 28672\n           MetaDataDiskWrites: 6\n\n           MftReads: 7\n           MftReadBytes: 57344\n           MftWrites: 4\n           MftWriteBytes: 28672\n           Mft2Writes: 0\n           Mft2WriteBytes: 0\n           RootIndexReads: 0\n           RootIndexReadBytes: 0\n           RootIndexWrites: 0\n           RootIndexWriteBytes: 0\n           BitmapReads: 1\n           BitmapReadBytes: 32768\n           BitmapWrites: 0\n           BitmapWriteBytes: 0\n           MftBitmapReads: 1\n           MftBitmapReadBytes: 8192\n           MftBitmapWrites: 0\n           MftBitmapWriteBytes: 0\n           UserIndexReads: 1\n           UserIndexReadBytes: 4096\n           UserIndexWrites: 2\n           UserIndexWriteBytes: 8192\n           LogFileReads: 8\n           LogFileReadBytes: 32768\n           LogFileWrites: 20\n           LogFileWriteBytes: 81920\n           LogFileFull: 0\n           LogFileFullReasons:\n                     LF_LOG_SPACE: 0\n                     LF_DIRTY_PAGES: 0\n                     LF_OPEN_ATTRIBUTES: 0\n                     LF_TRANSACTION_DRAIN: 0\n                     LF_FASTIO_CALLBACK: 0\n                     LF_DEALLOCATED_CLUSTERS: 0\n                     LF_DEALLOCATED_CLUSTERS_MEM: 0\n                     LF_RECORD_STACK_CHECK: 0\n                     LF_DISMOUNT: 0\n                     LF_COMPRESSION: 0\n                     LF_SNAPSHOT: 0\n                     LF_MOUNT: 0\n                     LF_SHUTDOWN: 0\n                     LF_RECURSIVE_COMPRESSION: 0\n                     LF_TESTING: 0\n\n           DiskResourceFailure: 0\n           VolumeTrimCount: 0\n                     VolumeTrimTime (ms): 0\n                     VolumeTrimSize (KB): 0\n                     AvgVolumeTrimTime (ms): 0\n                     AvgVolumeTrimSize (KB): 0\n           VolumeTrimSkippedCount: 0\n                     VolumeTrimSkippedSize (KB): 0\n           FileLevelTrimCount: 0\n                     FileLevelTrimTime (ms): 0\n                     FileLevelTrimSize (KB): 0\n                     AvgFileLevelTrimTime (ms): 0\n                     AvgFileLevelTrimSize (KB): 0\n           NtfsFillStatInfoFromMftRecordCalledCount: 0\n           NtfsFillStatInfoFromMftRecordBailedBecauseOfAttributeListCount: 0\n           NtfsFillStatInfoFromMftRecordBailedBecauseOfNonResReparsePointCount: 0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:43:53.001\t158\t\"NTFS metadata statistics for volume:\n\n           Volume Id: {f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n           Volume name: \\\\?\\Volume{f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n\n           UserFileReads: 18\n           UserFileReadBytes: 208896\n           UserDiskReads: 18\n           UserFileWrites: 0\n           UserFileWriteBytes: 0\n           UserDiskWrites: 0\n\n           MetaDataReads: 18\n           MetaDataReadBytes: 1048576\n           MetaDataDiskReads: 20\n           MetaDataWrites: 5\n           MetaDataWriteBytes: 40960\n           MetaDataDiskWrites: 8\n\n           MftReads: 11\n           MftReadBytes: 73728\n           MftWrites: 5\n           MftWriteBytes: 40960\n           Mft2Writes: 0\n           Mft2WriteBytes: 0\n           RootIndexReads: 0\n           RootIndexReadBytes: 0\n           RootIndexWrites: 0\n           RootIndexWriteBytes: 0\n           BitmapReads: 1\n           BitmapReadBytes: 819200\n           BitmapWrites: 0\n           BitmapWriteBytes: 0\n           MftBitmapReads: 1\n           MftBitmapReadBytes: 8192\n           MftBitmapWrites: 0\n           MftBitmapWriteBytes: 0\n           UserIndexReads: 1\n           UserIndexReadBytes: 4096\n           UserIndexWrites: 3\n           UserIndexWriteBytes: 12288\n           LogFileReads: 8\n           LogFileReadBytes: 32768\n           LogFileWrites: 24\n           LogFileWriteBytes: 102400\n           LogFileFull: 0\n           LogFileFullReasons:\n                     LF_LOG_SPACE: 0\n                     LF_DIRTY_PAGES: 0\n                     LF_OPEN_ATTRIBUTES: 0\n                     LF_TRANSACTION_DRAIN: 0\n                     LF_FASTIO_CALLBACK: 0\n                     LF_DEALLOCATED_CLUSTERS: 0\n                     LF_DEALLOCATED_CLUSTERS_MEM: 0\n                     LF_RECORD_STACK_CHECK: 0\n                     LF_DISMOUNT: 0\n                     LF_COMPRESSION: 0\n                     LF_SNAPSHOT: 0\n                     LF_MOUNT: 0\n                     LF_SHUTDOWN: 0\n                     LF_RECURSIVE_COMPRESSION: 0\n                     LF_TESTING: 0\n\n           DiskResourceFailure: 0\n           VolumeTrimCount: 0\n                     VolumeTrimTime (ms): 0\n                     VolumeTrimSize (KB): 0\n                     AvgVolumeTrimTime (ms): 0\n                     AvgVolumeTrimSize (KB): 0\n           VolumeTrimSkippedCount: 0\n                     VolumeTrimSkippedSize (KB): 0\n           FileLevelTrimCount: 0\n                     FileLevelTrimTime (ms): 0\n                     FileLevelTrimSize (KB): 0\n                     AvgFileLevelTrimTime (ms): 0\n                     AvgFileLevelTrimSize (KB): 0\n           NtfsFillStatInfoFromMftRecordCalledCount: 0\n           NtfsFillStatInfoFromMftRecordBailedBecauseOfAttributeListCount: 0\n           NtfsFillStatInfoFromMftRecordBailedBecauseOfNonResReparsePointCount: 0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:43:53.001\t158\t\"NTFS metadata statistics for volume:\n\n           Volume Id: {5285d7ae-0000-0000-007e-000000000000}\n           Volume name: E:\n\n           UserFileReads: 4\n           UserFileReadBytes: 16384\n           UserDiskReads: 1\n           UserFileWrites: 0\n           UserFileWriteBytes: 0\n           UserDiskWrites: 0\n\n           MetaDataReads: 43\n           MetaDataReadBytes: 6959104\n           MetaDataDiskReads: 47\n           MetaDataWrites: 5\n           MetaDataWriteBytes: 40960\n           MetaDataDiskWrites: 8\n\n           MftReads: 14\n           MftReadBytes: 86016\n           MftWrites: 5\n           MftWriteBytes: 40960\n           Mft2Writes: 0\n           Mft2WriteBytes: 0\n           RootIndexReads: 0\n           RootIndexReadBytes: 0\n           RootIndexWrites: 0\n           RootIndexWriteBytes: 0\n           BitmapReads: 7\n           BitmapReadBytes: 6557696\n           BitmapWrites: 0\n           BitmapWriteBytes: 0\n           MftBitmapReads: 1\n           MftBitmapReadBytes: 45056\n           MftBitmapWrites: 0\n           MftBitmapWriteBytes: 0\n           UserIndexReads: 4\n           UserIndexReadBytes: 16384\n           UserIndexWrites: 3\n           UserIndexWriteBytes: 12288\n           LogFileReads: 7\n           LogFileReadBytes: 28672\n           LogFileWrites: 19\n           LogFileWriteBytes: 77824\n           LogFileFull: 0\n           LogFileFullReasons:\n                     LF_LOG_SPACE: 0\n                     LF_DIRTY_PAGES: 0\n                     LF_OPEN_ATTRIBUTES: 0\n                     LF_TRANSACTION_DRAIN: 0\n                     LF_FASTIO_CALLBACK: 0\n                     LF_DEALLOCATED_CLUSTERS: 0\n                     LF_DEALLOCATED_CLUSTERS_MEM: 0\n                     LF_RECORD_STACK_CHECK: 0\n                     LF_DISMOUNT: 0\n                     LF_COMPRESSION: 0\n                     LF_SNAPSHOT: 0\n                     LF_MOUNT: 0\n                     LF_SHUTDOWN: 0\n                     LF_RECURSIVE_COMPRESSION: 0\n                     LF_TESTING: 0\n\n           DiskResourceFailure: 0\n           VolumeTrimCount: 0\n                     VolumeTrimTime (ms): 0\n                     VolumeTrimSize (KB): 0\n                     AvgVolumeTrimTime (ms): 0\n                     AvgVolumeTrimSize (KB): 0\n           VolumeTrimSkippedCount: 0\n                     VolumeTrimSkippedSize (KB): 0\n           FileLevelTrimCount: 0\n                     FileLevelTrimTime (ms): 0\n                     FileLevelTrimSize (KB): 0\n                     AvgFileLevelTrimTime (ms): 0\n                     AvgFileLevelTrimSize (KB): 0\n           NtfsFillStatInfoFromMftRecordCalledCount: 0\n           NtfsFillStatInfoFromMftRecordBailedBecauseOfAttributeListCount: 0\n           NtfsFillStatInfoFromMftRecordBailedBecauseOfNonResReparsePointCount: 0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:43:53.001\t158\t\"NTFS metadata statistics for volume:\n\n           Volume Id: {5285d7ae-0000-0000-0000-300432000000}\n           Volume name: F:\n\n           UserFileReads: 3817\n           UserFileReadBytes: 221736960\n           UserDiskReads: 3812\n           UserFileWrites: 0\n           UserFileWriteBytes: 0\n           UserDiskWrites: 0\n\n           MetaDataReads: 13270\n           MetaDataReadBytes: 76025856\n           MetaDataDiskReads: 24737\n           MetaDataWrites: 5308\n           MetaDataWriteBytes: 39563264\n           MetaDataDiskWrites: 7171\n\n           MftReads: 13172\n           MftReadBytes: 53981184\n           MftWrites: 5308\n           MftWriteBytes: 39563264\n           Mft2Writes: 0\n           Mft2WriteBytes: 0\n           RootIndexReads: 0\n           RootIndexReadBytes: 0\n           RootIndexWrites: 0\n           RootIndexWriteBytes: 0\n           BitmapReads: 21\n           BitmapReadBytes: 21409792\n           BitmapWrites: 0\n           BitmapWriteBytes: 0\n           MftBitmapReads: 3\n           MftBitmapReadBytes: 147456\n           MftBitmapWrites: 0\n           MftBitmapWriteBytes: 0\n           UserIndexReads: 11466\n           UserIndexReadBytes: 47067136\n           UserIndexWrites: 1863\n           UserIndexWriteBytes: 9351168\n           LogFileReads: 7\n           LogFileReadBytes: 28672\n           LogFileWrites: 388\n           LogFileWriteBytes: 10125312\n           LogFileFull: 0\n           LogFileFullReasons:\n                     LF_LOG_SPACE: 0\n                     LF_DIRTY_PAGES: 0\n                     LF_OPEN_ATTRIBUTES: 0\n                     LF_TRANSACTION_DRAIN: 0\n                     LF_FASTIO_CALLBACK: 0\n                     LF_DEALLOCATED_CLUSTERS: 0\n                     LF_DEALLOCATED_CLUSTERS_MEM: 0\n                     LF_RECORD_STACK_CHECK: 0\n                     LF_DISMOUNT: 0\n                     LF_COMPRESSION: 0\n                     LF_SNAPSHOT: 0\n                     LF_MOUNT: 0\n                     LF_SHUTDOWN: 0\n                     LF_RECURSIVE_COMPRESSION: 0\n                     LF_TESTING: 0\n\n           DiskResourceFailure: 0\n           VolumeTrimCount: 0\n                     VolumeTrimTime (ms): 0\n                     VolumeTrimSize (KB): 0\n                     AvgVolumeTrimTime (ms): 0\n                     AvgVolumeTrimSize (KB): 0\n           VolumeTrimSkippedCount: 0\n                     VolumeTrimSkippedSize (KB): 0\n           FileLevelTrimCount: 0\n                     FileLevelTrimTime (ms): 0\n                     FileLevelTrimSize (KB): 0\n                     AvgFileLevelTrimTime (ms): 0\n                     AvgFileLevelTrimSize (KB): 0\n           NtfsFillStatInfoFromMftRecordCalledCount: 0\n           NtfsFillStatInfoFromMftRecordBailedBecauseOfAttributeListCount: 0\n           NtfsFillStatInfoFromMftRecordBailedBecauseOfNonResReparsePointCount: 0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:43:53.001\t158\t\"NTFS metadata statistics for volume:\n\n           Volume Id: {5285d7ae-0000-0000-0000-a058d5000000}\n           Volume name: G:\n\n           UserFileReads: 1\n           UserFileReadBytes: 4096\n           UserDiskReads: 1\n           UserFileWrites: 0\n           UserFileWriteBytes: 0\n           UserDiskWrites: 0\n\n           MetaDataReads: 28\n           MetaDataReadBytes: 2891776\n           MetaDataDiskReads: 30\n           MetaDataWrites: 2\n           MetaDataWriteBytes: 24576\n           MetaDataDiskWrites: 4\n\n           MftReads: 9\n           MftReadBytes: 65536\n           MftWrites: 2\n           MftWriteBytes: 24576\n           Mft2Writes: 0\n           Mft2WriteBytes: 0\n           RootIndexReads: 0\n           RootIndexReadBytes: 0\n           RootIndexWrites: 0\n           RootIndexWriteBytes: 0\n           BitmapReads: 3\n           BitmapReadBytes: 2564096\n           BitmapWrites: 0\n           BitmapWriteBytes: 0\n           MftBitmapReads: 1\n           MftBitmapReadBytes: 16384\n           MftBitmapWrites: 0\n           MftBitmapWriteBytes: 0\n           UserIndexReads: 2\n           UserIndexReadBytes: 8192\n           UserIndexWrites: 2\n           UserIndexWriteBytes: 8192\n           LogFileReads: 7\n           LogFileReadBytes: 28672\n           LogFileWrites: 17\n           LogFileWriteBytes: 69632\n           LogFileFull: 0\n           LogFileFullReasons:\n                     LF_LOG_SPACE: 0\n                     LF_DIRTY_PAGES: 0\n                     LF_OPEN_ATTRIBUTES: 0\n                     LF_TRANSACTION_DRAIN: 0\n                     LF_FASTIO_CALLBACK: 0\n                     LF_DEALLOCATED_CLUSTERS: 0\n                     LF_DEALLOCATED_CLUSTERS_MEM: 0\n                     LF_RECORD_STACK_CHECK: 0\n                     LF_DISMOUNT: 0\n                     LF_COMPRESSION: 0\n                     LF_SNAPSHOT: 0\n                     LF_MOUNT: 0\n                     LF_SHUTDOWN: 0\n                     LF_RECURSIVE_COMPRESSION: 0\n                     LF_TESTING: 0\n\n           DiskResourceFailure: 0\n           VolumeTrimCount: 0\n                     VolumeTrimTime (ms): 0\n                     VolumeTrimSize (KB): 0\n                     AvgVolumeTrimTime (ms): 0\n                     AvgVolumeTrimSize (KB): 0\n           VolumeTrimSkippedCount: 0\n                     VolumeTrimSkippedSize (KB): 0\n           FileLevelTrimCount: 0\n                     FileLevelTrimTime (ms): 0\n                     FileLevelTrimSize (KB): 0\n                     AvgFileLevelTrimTime (ms): 0\n                     AvgFileLevelTrimSize (KB): 0\n           NtfsFillStatInfoFromMftRecordCalledCount: 0\n           NtfsFillStatInfoFromMftRecordBailedBecauseOfAttributeListCount: 0\n           NtfsFillStatInfoFromMftRecordBailedBecauseOfNonResReparsePointCount: 0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:43:56.735\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:43:57.912\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:57.912\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:44:00.855\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:01.045\t16394\tOffline downlevel migration succeeded.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 08:44:02.069\t219\tPSMFlags for Desktop AppX process %1 with applicationID %2 is %3.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:44:02.090\t201\tCreated process 5140 for application Microsoft.Office.ActionsServer_8wekyb3d8bbwe!Microsoft.Office.ActionsServer in package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe. [FinishPackageActivation]\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:44:02.300\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:02.968\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:03.192\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:03.416\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:03.639\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:03.843\t102\t\"Global Periodic Cache Information:\n\n                       Period Duration (microseconds): 916208946\n                       Number of NUMA Nodes: 111364\n                       Event Samples: 1\n                       Total Number of Mapped VACBs: 8256\n                       Total Partition Samples: 1\n                       Total Volume Samples: 10\n                       Total Pages Yet to Write: 166\n                       Total Dirty Pages: 158\n                       Total Available Pages: 4198001\n                       Total Physical Pages: 6167902\n                       Total Number of Worker Threads: 40\n                       Total Number of Active Worker Threads: 0\n                       Total Average Available Pages: 42725404\n                       Total Average Dirty Pages: 671\n                       CopyRead Calls: 821540\n                       AsyncCopyRead Calls: 1583\n                       CopyWriteCalls: 260285\n                       SetValidData Calls: 6602\n                       FlushCache Calls: 111364\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t103\t\"Volume Periodic Cache Information:\n\n                       Device GUID: {23606dfe-da07-4ad7-8798-8deaced0a66e}\n                       Period Duration (microseconds): 916208946\n                       Total Dirty Pages: 1696481441\n                       Maximum Dirty Pages: 41125\n                       Total Dirty Page Threshold: 110510569094\n                       Top Dirty Page Threshold: 770987\n                       Bottom Dirty Page Threshold: 770987\n                       Dirty Page Samples: 286227\n                       Total Lazy Writer Calls: 2990\n                       Total Lazy Writer Latency: 2086525\n                       Total Lazy Writer Pages Flushed: 125054\n                       Lazy Writer Average Pages Per Second: 59892\n                       Total Pages Queued to Disk: 39791875\n                       Maximum Pages Queued to Disk: 3471\n                       Pages Queued to Disk Samples: 82752\n                       Total Metadata Pages Queued to Disk: 20576438\n                       Maximum Metadata Pages Queued to Disk: 3185\n                       Metadata Pages Queued to Disk Samples: 82738\n                       Read Total Bytes: 133539294353\n                       Read Paged-In Total Bytes: 5964598671\n                       Read-Ahead Total Bytes: 0\n                       Cache Hit Ratio (%): 95\n                       Total Writes: 284210\n                       Total Hard-Throttle Writes: 0\n                       Total Soft-Throttle Writes: 0\n                       Total Synchronous Read IO Count: 805419\n                       Total Synchronous Non-Blocking Read IO Count: 13985\n                       Total Failed Synchronous Non-Blocking Read IO Count: 1567\n                       Synchronous Read IO Maximum Latency (us): 670202\n                       Synchronous Read IO Non-Blocking Maximum Latency (us): 0\n                       Total Synchronous Write IO Count: 258771\n                       Total Synchronous Non-Blocking Write IO Count: 687\n                       Total Failed Synchronous Non-Blocking Write IO Count: 2\n                       Synchronous Write IO Maximum Latency (us): 158385\n                       Synchronous Write IO Non-Blockinig Maximum Latency (us): 0\n                       Total Asynchronous Read IO Count: 1567\n                       Asynchronous Read IO Maximum Latency (us): 47306\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t104\t\"Volume Periodic Cache Read Latency Information:\n\n                       Device GUID: {23606dfe-da07-4ad7-8798-8deaced0a66e}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Read IO Counts: [801323, 3548, 293, 190, 60, 2, 1, 4, 0, 0, 0, 0]\n                       Synchronous Read IO Total Latencies (us): [2778311, 1455902, 549343, 1806526, 1774425, 228134, 166153, 1776138, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Counts: [13985, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Counts: [1331, 221, 8, 6, 1, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Total Latencies (us): [196180, 86986, 11680, 28305, 47306, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t105\t\"Volume Periodic Cache Write Latency Information:\n\n                       Device GUID: {23606dfe-da07-4ad7-8798-8deaced0a66e}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Write IO Counts: [257386, 1133, 73, 105, 70, 1, 3, 0, 0, 0, 0, 0]\n                       Synchronous Write IO Total Latencies (us): [638768, 464431, 144110, 1255233, 1935671, 74538, 442846, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Counts: [687, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t103\t\"Volume Periodic Cache Information:\n\n                       Device GUID: {00000000-0000-0000-0000-000000000000}\n                       Period Duration (microseconds): 916208946\n                       Total Dirty Pages: 0\n                       Maximum Dirty Pages: 0\n                       Total Dirty Page Threshold: 0\n                       Top Dirty Page Threshold: 0\n                       Bottom Dirty Page Threshold: 0\n                       Dirty Page Samples: 0\n                       Total Lazy Writer Calls: 0\n                       Total Lazy Writer Latency: 0\n                       Total Lazy Writer Pages Flushed: 0\n                       Lazy Writer Average Pages Per Second: 0\n                       Total Pages Queued to Disk: 0\n                       Maximum Pages Queued to Disk: 0\n                       Pages Queued to Disk Samples: 0\n                       Total Metadata Pages Queued to Disk: 0\n                       Maximum Metadata Pages Queued to Disk: 0\n                       Metadata Pages Queued to Disk Samples: 0\n                       Read Total Bytes: 12586496\n                       Read Paged-In Total Bytes: 2883584\n                       Read-Ahead Total Bytes: 0\n                       Cache Hit Ratio (%): 77\n                       Total Writes: 0\n                       Total Hard-Throttle Writes: 0\n                       Total Soft-Throttle Writes: 0\n                       Total Synchronous Read IO Count: 57\n                       Total Synchronous Non-Blocking Read IO Count: 0\n                       Total Failed Synchronous Non-Blocking Read IO Count: 0\n                       Synchronous Read IO Maximum Latency (us): 203\n                       Synchronous Read IO Non-Blocking Maximum Latency (us): 0\n                       Total Synchronous Write IO Count: 0\n                       Total Synchronous Non-Blocking Write IO Count: 0\n                       Total Failed Synchronous Non-Blocking Write IO Count: 0\n                       Synchronous Write IO Maximum Latency (us): 0\n                       Synchronous Write IO Non-Blockinig Maximum Latency (us): 0\n                       Total Asynchronous Read IO Count: 0\n                       Asynchronous Read IO Maximum Latency (us): 0\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t104\t\"Volume Periodic Cache Read Latency Information:\n\n                       Device GUID: {00000000-0000-0000-0000-000000000000}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Read IO Counts: [57, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read IO Total Latencies (us): [1437, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t105\t\"Volume Periodic Cache Write Latency Information:\n\n                       Device GUID: {00000000-0000-0000-0000-000000000000}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Write IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t103\t\"Volume Periodic Cache Information:\n\n                       Device GUID: {23cb36d7-dcac-4575-b04d-8288cc1f8e2a}\n                       Period Duration (microseconds): 916208946\n                       Total Dirty Pages: 143\n                       Maximum Dirty Pages: 12\n                       Total Dirty Page Threshold: 35706670\n                       Top Dirty Page Threshold: 770987\n                       Bottom Dirty Page Threshold: 770987\n                       Dirty Page Samples: 75\n                       Total Lazy Writer Calls: 0\n                       Total Lazy Writer Latency: 0\n                       Total Lazy Writer Pages Flushed: 0\n                       Lazy Writer Average Pages Per Second: 0\n                       Total Pages Queued to Disk: 13\n                       Maximum Pages Queued to Disk: 3\n                       Pages Queued to Disk Samples: 32\n                       Total Metadata Pages Queued to Disk: 0\n                       Maximum Metadata Pages Queued to Disk: 0\n                       Metadata Pages Queued to Disk Samples: 32\n                       Read Total Bytes: 89878528\n                       Read Paged-In Total Bytes: 13312000\n                       Read-Ahead Total Bytes: 0\n                       Cache Hit Ratio (%): 85\n                       Total Writes: 13\n                       Total Hard-Throttle Writes: 0\n                       Total Soft-Throttle Writes: 0\n                       Total Synchronous Read IO Count: 289\n                       Total Synchronous Non-Blocking Read IO Count: 0\n                       Total Failed Synchronous Non-Blocking Read IO Count: 0\n                       Synchronous Read IO Maximum Latency (us): 1149\n                       Synchronous Read IO Non-Blocking Maximum Latency (us): 0\n                       Total Synchronous Write IO Count: 8\n                       Total Synchronous Non-Blocking Write IO Count: 2\n                       Total Failed Synchronous Non-Blocking Write IO Count: 0\n                       Synchronous Write IO Maximum Latency (us): 1158\n                       Synchronous Write IO Non-Blockinig Maximum Latency (us): 0\n                       Total Asynchronous Read IO Count: 0\n                       Asynchronous Read IO Maximum Latency (us): 0\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t104\t\"Volume Periodic Cache Read Latency Information:\n\n                       Device GUID: {23cb36d7-dcac-4575-b04d-8288cc1f8e2a}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Read IO Counts: [228, 60, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read IO Total Latencies (us): [2679, 24883, 1149, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t105\t\"Volume Periodic Cache Write Latency Information:\n\n                       Device GUID: {23cb36d7-dcac-4575-b04d-8288cc1f8e2a}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Write IO Counts: [6, 1, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write IO Total Latencies (us): [331, 334, 1158, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Counts: [2, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t103\t\"Volume Periodic Cache Information:\n\n                       Device GUID: {b4de30fc-d998-46fa-9187-a8f915fd81fc}\n                       Period Duration (microseconds): 916208946\n                       Total Dirty Pages: 112\n                       Maximum Dirty Pages: 9\n                       Total Dirty Page Threshold: 5827067\n                       Top Dirty Page Threshold: 770987\n                       Bottom Dirty Page Threshold: 770987\n                       Dirty Page Samples: 32\n                       Total Lazy Writer Calls: 0\n                       Total Lazy Writer Latency: 0\n                       Total Lazy Writer Pages Flushed: 0\n                       Lazy Writer Average Pages Per Second: 0\n                       Total Pages Queued to Disk: 72\n                       Maximum Pages Queued to Disk: 9\n                       Pages Queued to Disk Samples: 18\n                       Total Metadata Pages Queued to Disk: 72\n                       Maximum Metadata Pages Queued to Disk: 9\n                       Metadata Pages Queued to Disk Samples: 18\n                       Read Total Bytes: 1048576\n                       Read Paged-In Total Bytes: 786432\n                       Read-Ahead Total Bytes: 0\n                       Cache Hit Ratio (%): 25\n                       Total Writes: 0\n                       Total Hard-Throttle Writes: 0\n                       Total Soft-Throttle Writes: 0\n                       Total Synchronous Read IO Count: 3\n                       Total Synchronous Non-Blocking Read IO Count: 0\n                       Total Failed Synchronous Non-Blocking Read IO Count: 1\n                       Synchronous Read IO Maximum Latency (us): 654\n                       Synchronous Read IO Non-Blocking Maximum Latency (us): 0\n                       Total Synchronous Write IO Count: 0\n                       Total Synchronous Non-Blocking Write IO Count: 0\n                       Total Failed Synchronous Non-Blocking Write IO Count: 0\n                       Synchronous Write IO Maximum Latency (us): 0\n                       Synchronous Write IO Non-Blockinig Maximum Latency (us): 0\n                       Total Asynchronous Read IO Count: 1\n                       Asynchronous Read IO Maximum Latency (us): 11599\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t104\t\"Volume Periodic Cache Read Latency Information:\n\n                       Device GUID: {b4de30fc-d998-46fa-9187-a8f915fd81fc}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Read IO Counts: [2, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read IO Total Latencies (us): [72, 654, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Counts: [0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Total Latencies (us): [0, 0, 0, 11599, 0, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t105\t\"Volume Periodic Cache Write Latency Information:\n\n                       Device GUID: {b4de30fc-d998-46fa-9187-a8f915fd81fc}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Write IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t103\t\"Volume Periodic Cache Information:\n\n                       Device GUID: {071ed15c-a672-4f3b-b36f-218dce297808}\n                       Period Duration (microseconds): 916208946\n                       Total Dirty Pages: 41\n                       Maximum Dirty Pages: 6\n                       Total Dirty Page Threshold: 4748802\n                       Top Dirty Page Threshold: 770987\n                       Bottom Dirty Page Threshold: 770987\n                       Dirty Page Samples: 18\n                       Total Lazy Writer Calls: 0\n                       Total Lazy Writer Latency: 0\n                       Total Lazy Writer Pages Flushed: 0\n                       Lazy Writer Average Pages Per Second: 0\n                       Total Pages Queued to Disk: 31\n                       Maximum Pages Queued to Disk: 5\n                       Pages Queued to Disk Samples: 22\n                       Total Metadata Pages Queued to Disk: 0\n                       Maximum Metadata Pages Queued to Disk: 0\n                       Metadata Pages Queued to Disk Samples: 22\n                       Read Total Bytes: 12767232\n                       Read Paged-In Total Bytes: 9007104\n                       Read-Ahead Total Bytes: 0\n                       Cache Hit Ratio (%): 29\n                       Total Writes: 0\n                       Total Hard-Throttle Writes: 0\n                       Total Soft-Throttle Writes: 0\n                       Total Synchronous Read IO Count: 86\n                       Total Synchronous Non-Blocking Read IO Count: 0\n                       Total Failed Synchronous Non-Blocking Read IO Count: 0\n                       Synchronous Read IO Maximum Latency (us): 5116\n                       Synchronous Read IO Non-Blocking Maximum Latency (us): 0\n                       Total Synchronous Write IO Count: 0\n                       Total Synchronous Non-Blocking Write IO Count: 0\n                       Total Failed Synchronous Non-Blocking Write IO Count: 0\n                       Synchronous Write IO Maximum Latency (us): 0\n                       Synchronous Write IO Non-Blockinig Maximum Latency (us): 0\n                       Total Asynchronous Read IO Count: 0\n                       Asynchronous Read IO Maximum Latency (us): 0\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t104\t\"Volume Periodic Cache Read Latency Information:\n\n                       Device GUID: {071ed15c-a672-4f3b-b36f-218dce297808}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Read IO Counts: [25, 56, 4, 1, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read IO Total Latencies (us): [1783, 23200, 5309, 5116, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t105\t\"Volume Periodic Cache Write Latency Information:\n\n                       Device GUID: {071ed15c-a672-4f3b-b36f-218dce297808}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Write IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t103\t\"Volume Periodic Cache Information:\n\n                       Device GUID: {580f6681-a25f-4cec-9096-3d65cabf1f4a}\n                       Period Duration (microseconds): 916208946\n                       Total Dirty Pages: 41\n                       Maximum Dirty Pages: 5\n                       Total Dirty Page Threshold: 4396111\n                       Top Dirty Page Threshold: 770987\n                       Bottom Dirty Page Threshold: 770987\n                       Dirty Page Samples: 18\n                       Total Lazy Writer Calls: 0\n                       Total Lazy Writer Latency: 0\n                       Total Lazy Writer Pages Flushed: 0\n                       Lazy Writer Average Pages Per Second: 0\n                       Total Pages Queued to Disk: 12\n                       Maximum Pages Queued to Disk: 4\n                       Pages Queued to Disk Samples: 8\n                       Total Metadata Pages Queued to Disk: 12\n                       Maximum Metadata Pages Queued to Disk: 4\n                       Metadata Pages Queued to Disk Samples: 8\n                       Read Total Bytes: 11113984\n                       Read Paged-In Total Bytes: 262144\n                       Read-Ahead Total Bytes: 0\n                       Cache Hit Ratio (%): 97\n                       Total Writes: 0\n                       Total Hard-Throttle Writes: 0\n                       Total Soft-Throttle Writes: 0\n                       Total Synchronous Read IO Count: 1\n                       Total Synchronous Non-Blocking Read IO Count: 38\n                       Total Failed Synchronous Non-Blocking Read IO Count: 5\n                       Synchronous Read IO Maximum Latency (us): 448\n                       Synchronous Read IO Non-Blocking Maximum Latency (us): 0\n                       Total Synchronous Write IO Count: 0\n                       Total Synchronous Non-Blocking Write IO Count: 0\n                       Total Failed Synchronous Non-Blocking Write IO Count: 0\n                       Synchronous Write IO Maximum Latency (us): 0\n                       Synchronous Write IO Non-Blockinig Maximum Latency (us): 0\n                       Total Asynchronous Read IO Count: 5\n                       Asynchronous Read IO Maximum Latency (us): 251\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t104\t\"Volume Periodic Cache Read Latency Information:\n\n                       Device GUID: {580f6681-a25f-4cec-9096-3d65cabf1f4a}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Read IO Counts: [0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read IO Total Latencies (us): [0, 448, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Counts: [38, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Counts: [5, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Total Latencies (us): [883, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t105\t\"Volume Periodic Cache Write Latency Information:\n\n                       Device GUID: {580f6681-a25f-4cec-9096-3d65cabf1f4a}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Write IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t103\t\"Volume Periodic Cache Information:\n\n                       Device GUID: {f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n                       Period Duration (microseconds): 916208946\n                       Total Dirty Pages: 59\n                       Maximum Dirty Pages: 5\n                       Total Dirty Page Threshold: 4552832\n                       Top Dirty Page Threshold: 770987\n                       Bottom Dirty Page Threshold: 770987\n                       Dirty Page Samples: 26\n                       Total Lazy Writer Calls: 0\n                       Total Lazy Writer Latency: 0\n                       Total Lazy Writer Pages Flushed: 0\n                       Lazy Writer Average Pages Per Second: 0\n                       Total Pages Queued to Disk: 24\n                       Maximum Pages Queued to Disk: 5\n                       Pages Queued to Disk Samples: 14\n                       Total Metadata Pages Queued to Disk: 24\n                       Maximum Metadata Pages Queued to Disk: 5\n                       Metadata Pages Queued to Disk Samples: 14\n                       Read Total Bytes: 12899840\n                       Read Paged-In Total Bytes: 1605632\n                       Read-Ahead Total Bytes: 0\n                       Cache Hit Ratio (%): 87\n                       Total Writes: 0\n                       Total Hard-Throttle Writes: 0\n                       Total Soft-Throttle Writes: 0\n                       Total Synchronous Read IO Count: 15\n                       Total Synchronous Non-Blocking Read IO Count: 38\n                       Total Failed Synchronous Non-Blocking Read IO Count: 5\n                       Synchronous Read IO Maximum Latency (us): 648\n                       Synchronous Read IO Non-Blocking Maximum Latency (us): 0\n                       Total Synchronous Write IO Count: 0\n                       Total Synchronous Non-Blocking Write IO Count: 0\n                       Total Failed Synchronous Non-Blocking Write IO Count: 0\n                       Synchronous Write IO Maximum Latency (us): 0\n                       Synchronous Write IO Non-Blockinig Maximum Latency (us): 0\n                       Total Asynchronous Read IO Count: 5\n                       Asynchronous Read IO Maximum Latency (us): 219\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t104\t\"Volume Periodic Cache Read Latency Information:\n\n                       Device GUID: {f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Read IO Counts: [6, 9, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read IO Total Latencies (us): [664, 3455, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Counts: [38, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Counts: [5, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Total Latencies (us): [842, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t105\t\"Volume Periodic Cache Write Latency Information:\n\n                       Device GUID: {f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Write IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t103\t\"Volume Periodic Cache Information:\n\n                       Device GUID: {5285d7ae-0000-0000-007e-000000000000}\n                       Period Duration (microseconds): 916208946\n                       Total Dirty Pages: 166\n                       Maximum Dirty Pages: 12\n                       Total Dirty Page Threshold: 9979559\n                       Top Dirty Page Threshold: 770987\n                       Bottom Dirty Page Threshold: 770987\n                       Dirty Page Samples: 28\n                       Total Lazy Writer Calls: 0\n                       Total Lazy Writer Latency: 0\n                       Total Lazy Writer Pages Flushed: 0\n                       Lazy Writer Average Pages Per Second: 0\n                       Total Pages Queued to Disk: 54\n                       Maximum Pages Queued to Disk: 12\n                       Pages Queued to Disk Samples: 14\n                       Total Metadata Pages Queued to Disk: 54\n                       Maximum Metadata Pages Queued to Disk: 12\n                       Metadata Pages Queued to Disk Samples: 14\n                       Read Total Bytes: 1572864\n                       Read Paged-In Total Bytes: 786432\n                       Read-Ahead Total Bytes: 0\n                       Cache Hit Ratio (%): 50\n                       Total Writes: 0\n                       Total Hard-Throttle Writes: 0\n                       Total Soft-Throttle Writes: 0\n                       Total Synchronous Read IO Count: 4\n                       Total Synchronous Non-Blocking Read IO Count: 0\n                       Total Failed Synchronous Non-Blocking Read IO Count: 2\n                       Synchronous Read IO Maximum Latency (us): 842\n                       Synchronous Read IO Non-Blocking Maximum Latency (us): 0\n                       Total Synchronous Write IO Count: 0\n                       Total Synchronous Non-Blocking Write IO Count: 0\n                       Total Failed Synchronous Non-Blocking Write IO Count: 0\n                       Synchronous Write IO Maximum Latency (us): 0\n                       Synchronous Write IO Non-Blockinig Maximum Latency (us): 0\n                       Total Asynchronous Read IO Count: 2\n                       Asynchronous Read IO Maximum Latency (us): 231\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t104\t\"Volume Periodic Cache Read Latency Information:\n\n                       Device GUID: {5285d7ae-0000-0000-007e-000000000000}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Read IO Counts: [3, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read IO Total Latencies (us): [84, 842, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Counts: [2, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Total Latencies (us): [264, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t105\t\"Volume Periodic Cache Write Latency Information:\n\n                       Device GUID: {5285d7ae-0000-0000-007e-000000000000}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Write IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t103\t\"Volume Periodic Cache Information:\n\n                       Device GUID: {5285d7ae-0000-0000-0000-300432000000}\n                       Period Duration (microseconds): 916208946\n                       Total Dirty Pages: 17970284\n                       Maximum Dirty Pages: 1448\n                       Total Dirty Page Threshold: 262370034\n                       Top Dirty Page Threshold: 770987\n                       Bottom Dirty Page Threshold: 770987\n                       Dirty Page Samples: 23884\n                       Total Lazy Writer Calls: 0\n                       Total Lazy Writer Latency: 0\n                       Total Lazy Writer Pages Flushed: 0\n                       Lazy Writer Average Pages Per Second: 0\n                       Total Pages Queued to Disk: 240804\n                       Maximum Pages Queued to Disk: 978\n                       Pages Queued to Disk Samples: 3612\n                       Total Metadata Pages Queued to Disk: 240804\n                       Maximum Metadata Pages Queued to Disk: 978\n                       Metadata Pages Queued to Disk Samples: 3612\n                       Read Total Bytes: 2621440\n                       Read Paged-In Total Bytes: 1048576\n                       Read-Ahead Total Bytes: 0\n                       Cache Hit Ratio (%): 60\n                       Total Writes: 0\n                       Total Hard-Throttle Writes: 0\n                       Total Soft-Throttle Writes: 0\n                       Total Synchronous Read IO Count: 8\n                       Total Synchronous Non-Blocking Read IO Count: 0\n                       Total Failed Synchronous Non-Blocking Read IO Count: 2\n                       Synchronous Read IO Maximum Latency (us): 785\n                       Synchronous Read IO Non-Blocking Maximum Latency (us): 0\n                       Total Synchronous Write IO Count: 0\n                       Total Synchronous Non-Blocking Write IO Count: 0\n                       Total Failed Synchronous Non-Blocking Write IO Count: 0\n                       Synchronous Write IO Maximum Latency (us): 0\n                       Synchronous Write IO Non-Blockinig Maximum Latency (us): 0\n                       Total Asynchronous Read IO Count: 2\n                       Asynchronous Read IO Maximum Latency (us): 10072\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t104\t\"Volume Periodic Cache Read Latency Information:\n\n                       Device GUID: {5285d7ae-0000-0000-0000-300432000000}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Read IO Counts: [7, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read IO Total Latencies (us): [110, 785, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Counts: [1, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Total Latencies (us): [26, 0, 0, 10072, 0, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t105\t\"Volume Periodic Cache Write Latency Information:\n\n                       Device GUID: {5285d7ae-0000-0000-0000-300432000000}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Write IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t103\t\"Volume Periodic Cache Information:\n\n                       Device GUID: {5285d7ae-0000-0000-0000-a058d5000000}\n                       Period Duration (microseconds): 916208946\n                       Total Dirty Pages: 65\n                       Maximum Dirty Pages: 8\n                       Total Dirty Page Threshold: 7844465\n                       Top Dirty Page Threshold: 770987\n                       Bottom Dirty Page Threshold: 770987\n                       Dirty Page Samples: 18\n                       Total Lazy Writer Calls: 0\n                       Total Lazy Writer Latency: 0\n                       Total Lazy Writer Pages Flushed: 0\n                       Lazy Writer Average Pages Per Second: 0\n                       Total Pages Queued to Disk: 19\n                       Maximum Pages Queued to Disk: 7\n                       Pages Queued to Disk Samples: 4\n                       Total Metadata Pages Queued to Disk: 19\n                       Maximum Metadata Pages Queued to Disk: 7\n                       Metadata Pages Queued to Disk Samples: 4\n                       Read Total Bytes: 524288\n                       Read Paged-In Total Bytes: 262144\n                       Read-Ahead Total Bytes: 0\n                       Cache Hit Ratio (%): 50\n                       Total Writes: 0\n                       Total Hard-Throttle Writes: 0\n                       Total Soft-Throttle Writes: 0\n                       Total Synchronous Read IO Count: 1\n                       Total Synchronous Non-Blocking Read IO Count: 0\n                       Total Failed Synchronous Non-Blocking Read IO Count: 1\n                       Synchronous Read IO Maximum Latency (us): 13931\n                       Synchronous Read IO Non-Blocking Maximum Latency (us): 0\n                       Total Synchronous Write IO Count: 0\n                       Total Synchronous Non-Blocking Write IO Count: 0\n                       Total Failed Synchronous Non-Blocking Write IO Count: 0\n                       Synchronous Write IO Maximum Latency (us): 0\n                       Synchronous Write IO Non-Blockinig Maximum Latency (us): 0\n                       Total Asynchronous Read IO Count: 1\n                       Asynchronous Read IO Maximum Latency (us): 24874\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t104\t\"Volume Periodic Cache Read Latency Information:\n\n                       Device GUID: {5285d7ae-0000-0000-0000-a058d5000000}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Read IO Counts: [0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read IO Total Latencies (us): [0, 0, 0, 13931, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Counts: [0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Total Latencies (us): [0, 0, 0, 0, 24874, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t105\t\"Volume Periodic Cache Write Latency Information:\n\n                       Device GUID: {5285d7ae-0000-0000-0000-a058d5000000}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Write IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:04.979\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:05.420\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:05.865\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:06.126\t2\tSecure Trustlet Id 6 and Pid 9244 stopped with status STATUS_SUCCESS.\tInformation\tSystem\tMicrosoft-Windows-IsolatedUserMode\n05.09.2026 08:44:06.199\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:06.422\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:06.649\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:06.871\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:07.758\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:08.358\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:44:08.358\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:44:08.899\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x48b0\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:44:08.899\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-503\n\tAccount Name:\t\tDefaultAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x48b0\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:44:08.900\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-504\n\tAccount Name:\t\tWDAGUtilityAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x48b0\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:44:08.901\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1009\n\tAccount Name:\t\tWsiAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x48b0\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:44:08.901\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-500\n\tAccount Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x48b0\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:44:08.901\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-501\n\tAccount Name:\t\t\u0413\u043e\u0441\u0442\u044c\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x48b0\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:44:08.902\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x48b0\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:44:08.903\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-503\n\tAccount Name:\t\tDefaultAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x48b0\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:44:08.903\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-504\n\tAccount Name:\t\tWDAGUtilityAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x48b0\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:44:08.903\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1009\n\tAccount Name:\t\tWsiAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x48b0\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:44:08.904\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-500\n\tAccount Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x48b0\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:44:08.904\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-501\n\tAccount Name:\t\t\u0413\u043e\u0441\u0442\u044c\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x48b0\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:44:08.911\t62443\tAppDefault Info: Querying default browser info\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:44:09.165\t1002\tError 0x80070002 occurred while verifying known folder {c4900540-2379-4c75-844b-64e6faf8716b} with path 'C:\\Users\\Public\\Pictures\\Sample Pictures'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:44:09.166\t1002\tError 0x80070002 occurred while verifying known folder {2a00375e-224c-49de-b8d1-440df7ef3ddc} with path 'C:\\WINDOWS\\resources\\0409'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:44:09.169\t1002\tError 0x80070002 occurred while verifying known folder {b250c668-f57d-4ee1-a63c-290ee7d1aa1f} with path 'C:\\Users\\Public\\Music\\Sample Music'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:44:09.174\t1002\tError 0x80070002 occurred while verifying known folder {859ead94-2e85-48ad-a71a-0969cb56a6cd} with path 'C:\\Users\\Public\\Videos\\Sample Videos'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:44:09.177\t1002\tError 0x80070002 occurred while verifying known folder {a440879f-87a0-4f7d-b700-0207b966194a} with path 'C:\\ProgramData\\Microsoft\\Windows\\Start Menu Places'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:44:09.199\t1002\tError 0x80070002 occurred while verifying known folder {c4900540-2379-4c75-844b-64e6faf8716b} with path 'C:\\Users\\Public\\Pictures\\Sample Pictures'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:44:09.200\t1002\tError 0x80070002 occurred while verifying known folder {2a00375e-224c-49de-b8d1-440df7ef3ddc} with path 'C:\\WINDOWS\\resources\\0409'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:44:09.202\t1002\tError 0x80070002 occurred while verifying known folder {b250c668-f57d-4ee1-a63c-290ee7d1aa1f} with path 'C:\\Users\\Public\\Music\\Sample Music'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:44:09.206\t1002\tError 0x80070002 occurred while verifying known folder {859ead94-2e85-48ad-a71a-0969cb56a6cd} with path 'C:\\Users\\Public\\Videos\\Sample Videos'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:44:09.207\t1002\tError 0x80070002 occurred while verifying known folder {a440879f-87a0-4f7d-b700-0207b966194a} with path 'C:\\ProgramData\\Microsoft\\Windows\\Start Menu Places'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:44:09.871\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:10.099\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:10.652\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:10.877\t8001\t\"Invoking license manager because license/lease polling time up: PFN A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (361)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:10.878\t8001\t\"ServicePackageRundownNotificationImpl PsmKey:A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6+App, sid:S-1-5-21-3712849175-2219398513-4278588552-1006\nFunction: ServicePackageRundownNotificationImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2587)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:10.878\t8011\t0x21f831d3840: 18884: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A: Dispatch: Key:Unregistered => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:10.878\t8001\t\"Lease dropped\nFunction: KeyMachine::DoDropLease\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (279)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:10.878\t8012\t0x21f831d3840: 18884: Key:Valid Change: Key:Invalid => 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:10.878\t8001\t\"Set results for lease = 0x0, policy = 0, operation = 0, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:10.878\t8011\t0x21f8312a620: 15996: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}: Dispatch: Lease:RemoveKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:10.878\t8011\t0x21f8312a620: 15996: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}: Dispatch: Lease:Unregistered => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:10.878\t8012\t0x21f8312a620: 15996: Lease:Valid Change: Lease:Invalid => {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:10.878\t8001\t\"Requesting lease document removal for reason 0x00000000, {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\nFunction: LicenseManagerCore::DoRemoveLeaseDocumentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (1460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:10.881\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2be1da80-9d39-1a56-8b4b-dca10f958cc2\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=80daf1f6-7afc-6d23-2c3c-f1e0a663029a&entitlementId=2be1da80-9d39-1a56-8b4b-dca10f958cc2&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"de7849ea-b8e4-60d1-c780-7b0969a99e76\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"80daf1f6-7afc-6d23-2c3c-f1e0a663029a\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NBLGGH0CB6D\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-09-04T15:27:12.2174791+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:10.881\t8001\t\"Ignoring lease removal with reason 0x00000000 because this is an offline lease\n\nFunction: ClipStorage::RemoveLeaseDocumentWithIdAndReason\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (501)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:10.882\t8002\t\"Trying to remove timer {1173A7B1-89F2-09CC-0563-CDED7D7397B9} not in table\nFunction: MemoryTimerService::CancelTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (80)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:10.882\t8001\t\"Removed timer for {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\nFunction: MemoryTimerService::CleanupTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (19)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:11.474\t8011\t0x21f831d3070: 18884: EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED: Dispatch: Key:Unregistered => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:11.474\t8001\t\"Lease dropped\nFunction: KeyMachine::DoDropLease\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (279)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:11.474\t8012\t0x21f831d3070: 18884: Key:Valid Change: Key:Invalid => EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:11.474\t8001\t\"Set results for lease = 0x0, policy = 0, operation = 0, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:11.475\t8011\t0x21f8312a820: 15996: {7BA318A1-DC47-F731-723C-537E883DC563}: Dispatch: Lease:RemoveKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:11.475\t8011\t0x21f8312a820: 15996: {7BA318A1-DC47-F731-723C-537E883DC563}: Dispatch: Lease:Unregistered => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:11.475\t8012\t0x21f8312a820: 15996: Lease:Valid Change: Lease:Invalid => {7BA318A1-DC47-F731-723C-537E883DC563}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:11.475\t8001\t\"Requesting lease document removal for reason 0x00000000, {7BA318A1-DC47-F731-723C-537E883DC563}\nFunction: LicenseManagerCore::DoRemoveLeaseDocumentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (1460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:11.478\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"200dc622-8cbd-e337-4d4b-69d2fa6e7df7\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966575679381420&contentId=eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed&entitlementId=200dc622-8cbd-e337-4d4b-69d2fa6e7df7&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"0f8e2cd5-b8eb-7a22-b9e9-9b1183fa0a84\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NMPJ99VJBWV\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-08-04T14:54:13.8630559+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:11.478\t8001\t\"Ignoring lease removal with reason 0x00000000 because this is an offline lease\n\nFunction: ClipStorage::RemoveLeaseDocumentWithIdAndReason\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (501)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:11.479\t8002\t\"Trying to remove timer {7BA318A1-DC47-F731-723C-537E883DC563} not in table\nFunction: MemoryTimerService::CancelTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (80)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:11.479\t8001\t\"Removed timer for {7BA318A1-DC47-F731-723C-537E883DC563}\nFunction: MemoryTimerService::CleanupTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (19)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:12.858\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:13.192\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:13.972\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:14.418\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:14.642\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:14.864\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:15.087\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:15.310\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:15.645\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:15.978\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:16.201\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:16.647\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:17.538\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:17.759\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:17.984\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:18.428\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:21.542\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:22.079\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:22.521\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:23.407\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:24.073\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:24.521\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:25.524\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:25.859\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:26.081\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:26.413\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:28.651\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:29.320\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:29.672\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:31.991\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:33.862\t26\tWindows Update successfully found 0 updates.\tInformation\tMicrosoft-Windows-WindowsUpdateClient/Operational\tMicrosoft-Windows-WindowsUpdateClient\n05.09.2026 08:44:34.545\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:36.440\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:36.774\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:36.998\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:37.665\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:38.000\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:38.221\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:38.777\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:39.447\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:39.669\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:40.557\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:40.778\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:40.999\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:41.557\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:41.780\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:41.874\t26\tWindows Update successfully found 2 updates.\tInformation\tMicrosoft-Windows-WindowsUpdateClient/Operational\tMicrosoft-Windows-WindowsUpdateClient\n05.09.2026 08:44:42.002\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:42.673\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:44.117\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:44.565\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:44.999\t3056\tTile Notification are being cleared for MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets - informed session 3.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:44:47.457\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:48.347\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:49.573\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:50.133\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:50.354\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:51.361\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:51.584\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:51.811\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:52.143\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:52.373\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:52.480\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:52.696\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:52.919\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:53.140\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:53.477\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:55.040\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:45:01.685\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, Win32_WIN32_TERMINALSERVICE_Prov, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:45:01.687\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, SppProvider, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:45:05.575\t8100\tStarting validation and setting the Trust Label on package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:45:05.576\t8106\tPackage Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe has Trust Label already. Flags: 0x103\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:45:05.576\t8101\tFinished validation and setting the Trust Label on package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:45:12.453\t16384\tSuccessfully scheduled Software Protection service for re-start at 2126-08-12T01:45:12Z. Reason: RulesEngine.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 08:45:31.700\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, Win32_TpmProvider, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:45:45.024\t2416\tA local notification was received from MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets [AppUserModelId] with a 0 [NotificationId] through an application endpoint.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:45:45.027\t2418\tA local notification was submitted to threadpool: MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets [AppUserModelId] tile [NotificationType] 9399 [NotificationTrackingId] Local [NotificationSource].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:45:45.043\t3053\ttile with notification tracking id 9399 is being delivered to MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:46:47.009\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:47:16.664\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:47:19.081\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:47:20.644\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:47:28.226\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:47:28.255\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:47:28.255\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:47:28.261\t505\t\"Compatibility fix applied to C:\\WINDOWS\\system32\\backgroundTaskHost.exe.\nFix information: Microsoft Apps, {81ecdb97-5112-41af-9a59-5ba9444f4270}, 0x80010101.\"\tInformation\tMicrosoft-Windows-Application-Experience/Program-Telemetry\tMicrosoft-Windows-Application-Experience\n05.09.2026 08:47:37.038\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:47:37.039\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:47:37.124\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:47:37.124\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:47:45.896\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:47:45.896\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:47:45.896\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:47:45.912\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:00.646\t1005\tThe Connection Provider status changed to Disconnected.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:00.646\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:00.646\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:00.646\t1005\tThe Connection Provider status changed to Disconnected.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:00.646\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:00.646\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:00.658\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:00.672\t1113\tDevice Compact Ticket request completed with Device Id 00180018E4F8342E for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:00.674\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:00.683\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:00.684\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:00.684\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:00.687\t8001\t\"Skipping license manager: PFN Microsoft.WindowsFeedbackHub_2.2606.702.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:48:00.687\t8001\t\"Skipping license manager: PFN Microsoft.WindowsFeedbackHub_2.2606.702.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:48:09.464\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:09.465\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:09.472\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:09.472\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:14.822\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:48:18.258\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:18.259\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:18.259\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:18.263\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:47.539\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:48:47.876\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:49:00.891\t8001\t\"Skipping license manager: PFN Microsoft.WindowsFeedbackHub_2.2606.702.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:49:00.992\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:49:05.786\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:49:08.570\t326\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1006.\tVerbose\tMicrosoft-Windows-AppXDeployment/Operational\tMicrosoft-Windows-AppXDeployment\n05.09.2026 08:49:08.574\t819\tThe following packages will be installed: . The following packages will be removed: \tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:49:08.731\t327\tThe following packages will be installed: NULL. The following packages will be removed: NULL\tVerbose\tMicrosoft-Windows-AppXDeployment/Operational\tMicrosoft-Windows-AppXDeployment\n05.09.2026 08:49:11.483\t102\tClipSVC service has shutdown.\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 08:49:26.439\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:49:26.998\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:49:28.113\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:49:29.332\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:49:29.555\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:49:35.584\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:49:39.146\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:50:40.478\t3057\tPresentation Endpoint received a call to close session 3.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:50:40.478\t3058\tPresentation Endpoint ended a call to close session 3.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:50:40.478\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:50:40.478\t3004\tTile session 3 is being closed\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:50:40.478\t3005\tTile session 3 is closed with error code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:50:41.517\t811\tThe winlogon notification subscriber  began handling the notification event (4).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:50:41.519\t812\tThe winlogon notification subscriber  finished handling the notification event (4).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:50:41.519\t811\tThe winlogon notification subscriber  began handling the notification event (4).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:50:41.520\t812\tThe winlogon notification subscriber  finished handling the notification event (4).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:50:41.528\t2\t{\"category\":\"Navigation\",\"level\":\"Information\",\"message\":\"Reload/unload page\",\"parameters\":{\"caller\":\"OnSessionStateChanged\",\"sessionState\":\"Lock\",\"mainWindowVisible\":\"False\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:50:41.538\t177\tReceived console locked notification\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:50:41.544\t2\t{\"category\":\"DcaTelemetry\",\"level\":\"Information\",\"message\":\"App_Extension\",\"parameters\":{\"collectionEnabled\":false,\"status\":\"Exited\",\"value\":\"PerformanceMetrics\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:50:41.545\t2\t{\"category\":\"DcaTelemetry\",\"level\":\"Information\",\"message\":\"App_Extension\",\"parameters\":{\"collectionEnabled\":false,\"status\":\"Exited\",\"value\":\"Performance\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:50:41.548\t8100\tStarting validation and setting the Trust Label on package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:50:41.549\t8106\tPackage Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe has Trust Label already. Flags: 0x103\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:50:41.549\t8101\tFinished validation and setting the Trust Label on package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:50:41.554\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:50:41.554\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:50:41.559\t8100\tStarting validation and setting the Trust Label on package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:50:41.561\t8106\tPackage Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe has Trust Label already. Flags: 0x103\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:50:41.561\t8101\tFinished validation and setting the Trust Label on package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:50:41.617\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x10c4\n\tProcess Name:\t\tC:\\Windows\\System32\\LogonUI.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:50:43.147\t2416\tA local notification was received from MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets [AppUserModelId] with a 0 [NotificationId] through an application endpoint.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:50:43.149\t2418\tA local notification was submitted to threadpool: MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets [AppUserModelId] tile [NotificationType] 9400 [NotificationTrackingId] Local [NotificationSource].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:01.912\t211\tAdded process 2696 to Desktop AppX container 245cdaf2-a8c9-11f1-b7ff-289200f24a99 for package MicrosoftWindows.Client.CBS_1000.26100.344.0_x64__cw5n1h2txyewy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:51:14.641\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:51:14.641\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:51:14.887\t10\t\tError\tIntel-Gfx-Display-External/GfxDisplayExEventViewer\tIntel-Gfx-Display-External\n05.09.2026 08:51:15.033\t507\t\"The system is exiting Modern Standby \n\nReason: Input Keyboard.\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Power\n05.09.2026 08:51:15.033\t566\t\"The system session has transitioned from 1 to 3.\n\nReason InputAccelerometer \n\nBootId: 82\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Power\n05.09.2026 08:51:15.055\t179\tReceived session display notification\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:51:15.055\t1025\tA Power event was fired: MonitorSettingChange [PowerEventType] true [Enabled].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:15.056\t1025\tA Power event was fired: MonitorSettingChange [PowerEventType] true [Enabled].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:16.562\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:16.562\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:16.563\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:16.563\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:16.565\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:16.566\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:16.568\t1113\tDevice Compact Ticket request completed with Device Id 00180018E4F8342E for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:16.578\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:16.579\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:16.579\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:16.875\t12289\t\"DPAPI found credential key.\n\n \tCredential Key Identifier:\t0x06D97C618B44CF98843820BCDDCC91F4B12D43F5A34189AE108C7BC82636830E\n \tUser Name:\tadmin\n \tUser Sid:\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\"\tInformation\tMicrosoft-Windows-Crypto-DPAPI/Operational\tMicrosoft-Windows-Crypto-DPAPI\n05.09.2026 08:51:16.875\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x6c4\n\tProcess Name:\t\tC:\\Windows\\System32\\lsass.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:51:16.878\t12289\t\"DPAPI found credential key.\n\n \tCredential Key Identifier:\t0x06D97C618B44CF98843820BCDDCC91F4B12D43F5A34189AE108C7BC82636830E\n \tUser Name:\tadmin\n \tUser Sid:\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\"\tInformation\tMicrosoft-Windows-Crypto-DPAPI/Operational\tMicrosoft-Windows-Crypto-DPAPI\n05.09.2026 08:51:16.879\t12289\t\"DPAPI found credential key.\n\n \tCredential Key Identifier:\t0x06D97C618B44CF98843820BCDDCC91F4B12D43F5A34189AE108C7BC82636830E\n \tUser Name:\tadmin\n \tUser Sid:\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\"\tInformation\tMicrosoft-Windows-Crypto-DPAPI/Operational\tMicrosoft-Windows-Crypto-DPAPI\n05.09.2026 08:51:16.888\t4648\t\"A logon was attempted using explicit credentials.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nAccount Whose Credentials Were Used:\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nTarget Server:\n\tTarget Server Name:\tlocalhost\n\tAdditional Information:\tlocalhost\n\nProcess Information:\n\tProcess ID:\t\t0xb88\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\n\nNetwork Information:\n\tNetwork Address:\t127.0.0.1\n\tPort:\t\t\t0\n\nThis event is generated when a process attempts to log on an account by explicitly specifying that account\u2019s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:51:16.888\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t2\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0xB3E143\n\tLinked Logon ID:\t\t0xB3E17C\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0xb88\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\n\nNetwork Information:\n\tWorkstation Name:\tHONOR-FRG-X\n\tSource Network Address:\t127.0.0.1\n\tSource Port:\t\t0\n\nDetailed Authentication Information:\n\tLogon Process:\t\tUser32 \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:51:16.888\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t2\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tNo\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0xB3E17C\n\tLinked Logon ID:\t\t0xB3E143\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0xb88\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\n\nNetwork Information:\n\tWorkstation Name:\tHONOR-FRG-X\n\tSource Network Address:\t127.0.0.1\n\tSource Port:\t\t0\n\nDetailed Authentication Information:\n\tLogon Process:\t\tUser32 \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:51:16.888\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0xB3E143\n\nPrivileges:\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:51:16.888\t4634\t\"An account was logged off.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0xB3E17C\n\nLogon Type:\t\t\t2\n\nThis event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:51:16.889\t4634\t\"An account was logged off.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0xB3E143\n\nLogon Type:\t\t\t2\n\nThis event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:51:16.892\t811\tThe winlogon notification subscriber  began handling the notification event (5).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:51:16.893\t812\tThe winlogon notification subscriber  finished handling the notification event (5).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:51:16.893\t811\tThe winlogon notification subscriber  began handling the notification event (5).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:51:16.896\t812\tThe winlogon notification subscriber  finished handling the notification event (5).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:51:16.897\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -s CertPropSvc( #0x0/0x8392 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:51:16.908\t2\t{\"category\":\"Navigation\",\"level\":\"Information\",\"message\":\"Reload/unload page\",\"parameters\":{\"caller\":\"OnSessionStateChanged\",\"sessionState\":\"Active\",\"mainWindowVisible\":\"False\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:17.109\t1402\tData Store Cache secondary data reconciliation start.\tInformation\tMicrosoft-Windows-ShellCommon-StartLayoutPopulation/Operational\tMicrosoft-Windows-ShellCommon-StartLayoutPopulation\n05.09.2026 08:51:17.113\t1403\tData Store Cache secondary data reconciliation end.\tInformation\tMicrosoft-Windows-ShellCommon-StartLayoutPopulation/Operational\tMicrosoft-Windows-ShellCommon-StartLayoutPopulation\n05.09.2026 08:51:17.137\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:17.309\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:17.334\t177\tReceived console locked notification\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:51:17.400\t5007\t\"\u0410\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043d\u0430\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430 Microsoft Defender Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.\n \tOld value: HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\UX Configuration\\ToastOrSsoTrigger = 0x0\n \tNew value: HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\UX Configuration\\ToastOrSsoTrigger = 0x1\"\tInformation\tMicrosoft-Windows-Windows Defender/Operational\tMicrosoft-Windows-Windows Defender\n05.09.2026 08:51:17.484\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:17.659\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:17.937\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:18.111\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:18.293\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:18.466\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:18.642\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:18.813\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:18.993\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:19.171\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:19.342\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:19.617\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:19.822\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:20.046\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:20.124\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:20.324\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:20.512\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:20.697\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:20.984\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:21.188\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:21.376\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:21.564\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:21.771\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:21.962\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:22.149\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:22.442\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:22.629\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:22.830\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:23.013\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:23.210\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:23.394\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:23.593\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:23.794\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:23.976\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:24.257\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:24.553\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:24.740\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:24.927\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:25.130\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:25.320\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:25.356\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:25.356\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:25.376\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:25.376\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:25.523\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:25.708\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:25.910\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:26.205\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:26.399\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:26.584\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:26.770\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:26.977\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:27.143\t171\tThe reader was created successfully for app package Microsoft.SecHealthUI_1000.29628.1000.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppxPackaging/Operational\tMicrosoft-Windows-AppxPackagingOM\n05.09.2026 08:51:27.272\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:27.465\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:27.658\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:27.947\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:28.236\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:28.430\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:28.629\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:28.816\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:29.001\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:29.193\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:29.376\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:29.555\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:29.844\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:30.060\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:30.234\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:30.421\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:30.609\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:30.809\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:31.001\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:31.178\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:31.477\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:31.662\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:31.857\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:32.049\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:32.229\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:32.418\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:32.619\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:32.800\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:33.002\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:33.193\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:33.487\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:33.682\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:33.861\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:34.151\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:34.152\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:34.152\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:34.164\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:34.165\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:34.459\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:34.649\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:34.843\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:35.027\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:35.215\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:35.413\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:35.593\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:35.883\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:36.078\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:36.271\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:36.464\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:36.647\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:36.840\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:37.038\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:37.336\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:37.537\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:37.742\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:37.947\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:38.167\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:38.456\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:38.653\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:38.855\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:39.148\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:39.335\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:39.513\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:39.805\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:39.995\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:40.190\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:40.373\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:40.573\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:40.756\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:40.942\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:41.140\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:41.321\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:41.500\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:41.697\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:41.914\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:41.983\t8001\t\"Skipping license manager: PFN Microsoft.ZuneMusic_11.2605.14.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:51:41.983\t8001\t\"Skipping license manager: PFN Microsoft.ZuneMusic_11.2605.14.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:51:42.212\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:42.392\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:42.504\t21\tSound level for application [Microsoft.ZuneMusic_8wekyb3d8bbwe!Microsoft.ZuneMusic] changed to [2]\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 08:51:42.669\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:42.848\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:43.022\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:43.194\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:43.397\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:43.575\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:43.625\t8100\tStarting validation and setting the Trust Label on package Microsoft.AV1VideoExtension_2.0.7.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:51:43.626\t8106\tPackage Microsoft.AV1VideoExtension_2.0.7.0_x64__8wekyb3d8bbwe has Trust Label already. Flags: 0x103\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:51:43.626\t8101\tFinished validation and setting the Trust Label on package Microsoft.AV1VideoExtension_2.0.7.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:51:43.772\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:43.979\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:44.172\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:44.369\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:44.425\t21\tSound level for application [Microsoft.ZuneMusic_8wekyb3d8bbwe!Microsoft.ZuneMusic] changed to [2]\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 08:51:44.426\t24\t\"Stream started.\nApp Id: Microsoft.ZuneMusic_8wekyb3d8bbwe!Microsoft.ZuneMusic\nPID: 7612\nAudio Stream Category: 11\"\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 08:51:44.574\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:44.771\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:44.972\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:45.165\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:45.171\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"Microsoft.Media.Player\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:46.489\t25\t\"Stream stopped.\nApp Id: Microsoft.ZuneMusic_8wekyb3d8bbwe!Microsoft.ZuneMusic\nPID: 7612\nAudio Stream Category: 11\"\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 08:51:47.116\t24\t\"Stream started.\nApp Id: Microsoft.ZuneMusic_8wekyb3d8bbwe!Microsoft.ZuneMusic\nPID: 7612\nAudio Stream Category: 11\"\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 08:51:47.426\t25\t\"Stream stopped.\nApp Id: Microsoft.ZuneMusic_8wekyb3d8bbwe!Microsoft.ZuneMusic\nPID: 7612\nAudio Stream Category: 11\"\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 08:51:47.445\t24\t\"Stream started.\nApp Id: Microsoft.ZuneMusic_8wekyb3d8bbwe!Microsoft.ZuneMusic\nPID: 7612\nAudio Stream Category: 11\"\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 08:51:53.376\t25\t\"Stream stopped.\nApp Id: Microsoft.ZuneMusic_8wekyb3d8bbwe!Microsoft.ZuneMusic\nPID: 7612\nAudio Stream Category: 11\"\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 08:51:58.706\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:58.709\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:59.347\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:59.353\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"explorer\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:52:00.396\t8000\t\"Process Name: C:\\WINDOWS\\Explorer.EXE\nModule Name: C:\\WINDOWS\\SYSTEM32\\licensemanagerapi.dll\nBuild: 26100.1.amd64fre.ge_release.240331-1435\n\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:52:00.397\t8001\t\"canDisableApps value is 0\nFunction: InitStoreAppsAreDisabled\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (195)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:52:00.420\t8001\t\"Skipping license manager: PFN Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:52:00.421\t219\tPSMFlags for Desktop AppX process %1 with applicationID %2 is %3.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:52:00.455\t210\tCreated Desktop AppX container {245CDDAB-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:52:00.455\t211\tAdded process 9528 to Desktop AppX container 245cddab-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:52:00.459\t201\tCreated process 9528 for application Microsoft.WindowsNotepad_8wekyb3d8bbwe!App in package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe. [LaunchProcess]\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:52:05.217\t217\tDestroyed Desktop AppX container {245CDDAB-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:52:12.951\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:52:12.957\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:52:36.067\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:52:47.021\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, CIMWin32, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:52:54.548\t300\tCompositor Type: 1WINWORDP1: %3P2: %4P3: %5P4: %6\tInformation\tOAlerts\tMicrosoft Office 16 Alerts\n05.09.2026 08:52:54.839\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:54.872\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:52:54.938\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:54.938\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:55.018\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:55.018\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:55.019\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:55.030\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:55.030\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:55.030\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:55.422\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:55.424\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:55.424\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:55.426\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:55.428\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p -s wlidsvc( #0x0/0x2208 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:52:55.459\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:55.461\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:55.463\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p -s wlidsvc( #0x0/0x2208 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:52:55.491\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:55.492\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.074\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:52:56.082\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"WINWORD\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:52:56.510\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.510\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.511\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.511\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.512\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.512\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.513\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.513\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.513\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.513\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.513\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.513\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.513\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.514\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.514\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.514\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.514\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.514\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.514\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.514\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.514\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.514\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.514\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.515\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.515\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.515\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.515\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.515\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.515\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.515\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.516\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tRead Credential\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.516\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tRead Credential\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.518\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.518\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.518\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.518\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.518\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.519\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.519\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.519\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.520\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.520\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.520\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.520\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.520\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.520\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.520\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.521\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.521\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.521\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.521\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.521\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.521\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.521\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.521\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.522\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.522\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.522\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.524\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.524\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.524\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.524\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.524\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.525\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.525\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.525\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.525\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.525\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.526\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.526\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.526\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.526\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.526\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.526\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.526\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.526\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.526\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.527\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.527\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.527\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.527\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.527\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.527\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.527\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.529\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.530\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.532\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.532\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.547\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.548\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.548\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.548\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.548\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.548\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.548\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.548\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.549\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.549\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.549\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.549\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.549\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.549\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.550\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.550\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.550\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.550\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.551\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.551\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.551\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.551\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.551\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.551\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.551\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.551\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.552\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.552\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.605\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.607\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.607\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.607\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.609\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p -s wlidsvc( #0x0/0x2208 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:52:56.609\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.039\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.040\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.040\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.040\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.040\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.040\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.041\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.041\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.041\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.041\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.041\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.041\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.041\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.042\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.042\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.042\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tRead Credential\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.048\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.048\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.048\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.048\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.049\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.049\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.049\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.049\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.049\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.049\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.050\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.050\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.050\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.054\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.055\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.055\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.055\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.055\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.055\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.055\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.055\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.056\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.056\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.056\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.056\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.056\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.057\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.057\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.073\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.073\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.073\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.073\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.074\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.074\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.074\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.074\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.074\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.074\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.075\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.075\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.075\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.075\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.279\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.280\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.281\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.281\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.282\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p -s wlidsvc( #0x0/0x2208 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:52:57.283\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.699\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.699\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.700\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.700\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.700\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.700\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.700\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.700\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.701\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.701\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.701\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.701\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.701\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.701\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.702\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.702\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tRead Credential\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.706\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.706\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.706\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.707\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.707\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.707\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.707\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.707\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.707\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.708\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.708\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.708\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.708\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.712\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.713\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.713\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.713\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.713\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.713\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.713\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.713\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.714\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.714\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.714\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.714\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.714\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.715\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.716\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.734\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.735\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.735\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.735\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.735\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.735\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.735\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.735\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.736\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.736\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.736\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.736\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.736\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.736\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.437\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.439\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.439\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.440\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.442\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p -s wlidsvc( #0x0/0x2208 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:53:02.444\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.894\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.894\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.895\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.896\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.896\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.897\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.898\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.898\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.899\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.899\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.900\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.900\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.901\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.902\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.902\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.903\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tRead Credential\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.913\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.913\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.913\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.914\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.915\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.915\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.915\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.915\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.915\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.915\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.916\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.916\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.916\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.921\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.922\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.922\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.922\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.922\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.922\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.923\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.923\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.923\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.923\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.923\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.923\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.923\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.924\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.925\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.939\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.939\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.940\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.940\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.940\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.940\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.940\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.941\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.941\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.941\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.941\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.941\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.941\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.941\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:11.337\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:53:11.344\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:53:11.778\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:53:12.110\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:53:12.442\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:53:12.665\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:53:13.190\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x3984\n\tProcess Name:\t\tC:\\Program Files\\Google\\Chrome\\Application\\chrome.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:13.221\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:53:13.431\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:53:13.645\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:53:13.663\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:53:13.669\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:53:54.629\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, CIMWin32, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:54:11.248\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:11.253\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:12.137\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:12.360\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:12.584\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:13.592\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:13.817\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:14.263\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:14.486\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:14.710\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:14.932\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:15.156\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:15.381\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:15.441\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:15.450\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:32.421\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:32.425\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:32.759\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:32.981\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:33.316\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:33.759\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:34.095\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:34.541\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:34.984\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:35.209\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:35.421\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:35.864\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:36.531\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:36.863\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:37.197\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:37.530\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:37.754\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:38.089\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:38.312\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:38.534\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:38.756\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:38.978\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:39.206\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:39.312\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:39.426\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:39.531\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:39.866\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:40.538\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:40.760\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:41.321\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:41.545\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:42.210\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:42.432\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:42.989\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:43.322\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:43.648\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:43.863\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:44.196\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:44.417\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:44.639\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:44.863\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:45.638\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:45.860\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:46.083\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:46.302\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:46.971\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:47.640\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:47.976\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:48.199\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:48.872\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:49.088\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:49.293\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:50.955\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:51.401\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:51.624\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:52.284\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:52.506\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:52.714\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:53.379\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:53.601\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:53.926\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:54.925\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:55.150\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:55.596\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:56.043\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:56.601\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:56.935\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:57.156\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:57.489\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:58.154\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:58.932\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:59.488\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:59.709\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:00.042\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:00.266\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:00.486\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:00.708\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:02.372\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:02.595\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:02.928\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:03.067\t300\tCompositor Type: 1WINWORDP1: %3P2: %4P3: %5P4: %6\tInformation\tOAlerts\tMicrosoft Office 16 Alerts\n05.09.2026 08:55:03.474\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:04.029\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:04.475\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:04.695\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:05.359\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:05.580\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:05.916\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:06.253\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:06.585\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:06.590\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"WINWORD\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:08.479\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:08.481\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:08.809\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:09.032\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:09.480\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:10.374\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:10.597\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:11.152\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:12.042\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:12.377\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:12.600\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:12.824\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:13.048\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:13.383\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:13.715\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:14.382\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:14.605\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:14.827\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:15.496\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:16.163\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:16.496\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:16.831\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:17.053\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:17.832\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:18.390\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:18.724\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:18.946\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:19.170\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:20.168\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:20.390\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:20.724\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:21.395\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:22.284\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:22.491\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:22.927\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:23.151\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:23.485\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:23.706\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:23.930\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:24.490\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:24.712\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:24.935\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:26.159\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:26.379\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:26.714\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:27.050\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:27.272\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:27.496\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:27.719\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:27.941\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:28.162\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:28.497\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:28.719\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:29.053\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:29.276\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:29.500\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:29.724\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:30.392\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:30.842\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:32.838\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:33.613\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:33.835\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:34.394\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:34.731\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:35.058\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:35.616\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:35.835\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:36.050\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:37.386\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:37.610\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:37.946\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:38.280\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:38.615\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:38.835\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:39.277\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:39.722\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:40.057\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:40.391\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:40.612\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:42.060\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:42.506\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:42.843\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:43.288\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:43.622\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:44.065\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:44.399\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:44.622\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:44.845\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:45.070\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:45.405\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:46.074\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:46.518\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:46.961\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:47.182\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:47.405\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:47.627\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:47.850\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:48.074\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:48.392\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:49.177\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:49.399\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:49.621\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:49.843\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:50.177\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:50.392\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:50.716\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:51.719\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:52.270\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:52.279\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:52.284\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"StartMenuExperienceHost\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:57.653\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:57.657\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:57.991\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:58.213\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:58.434\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:59.214\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:59.771\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:59.994\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:00.549\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:00.995\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:01.327\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:01.550\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:01.768\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:01.994\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:02.219\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:02.440\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:03.108\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:03.315\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:03.758\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:04.425\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:04.867\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:05.091\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:05.647\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:05.868\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:06.760\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:07.094\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:07.317\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:07.539\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:07.761\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:08.762\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:08.986\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:09.314\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:09.758\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:09.980\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:10.755\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:10.963\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:11.848\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:12.070\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:12.736\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:12.957\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:13.626\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:13.851\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:14.629\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:15.628\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:16.183\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:16.516\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:16.959\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:17.292\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:17.516\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:18.410\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:18.744\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:19.301\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:19.850\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:20.075\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:20.632\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:20.965\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:21.291\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:21.514\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:21.962\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:22.744\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:22.967\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:23.187\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:23.410\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:23.631\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:23.853\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:24.078\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:24.303\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:24.521\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:24.726\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:24.945\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:25.160\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:25.368\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:25.697\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:25.903\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:27.459\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:27.792\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:28.021\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:28.359\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:28.573\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:28.793\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:29.011\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:29.222\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:29.432\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:29.650\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:29.864\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:30.192\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:30.406\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:30.614\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:30.836\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:31.160\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:31.384\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:31.599\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:31.806\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:32.460\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:33.236\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:33.463\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:33.684\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:33.908\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:34.122\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:34.344\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:34.557\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:34.766\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:34.985\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:34.993\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:35.000\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:37.994\t3033\tCode Integrity determined that a process (\\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\chrome.exe) attempted to load \\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\152.0.7977.77\\vk_swiftshader.dll that did not meet the Microsoft signing level requirements.\tError\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:56:37.994\t3089\tSignature information for another event. Match using the Correlation Id.\tInformation\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:56:37.994\t12\tProcess '\\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\chrome.exe' (PID 14924) was blocked from loading the non-Microsoft-signed binary '\\Program Files\\Google\\Chrome\\Application\\152.0.7977.77\\vk_swiftshader.dll'.\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:56:38.021\t3033\tCode Integrity determined that a process (\\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\chrome.exe) attempted to load \\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\152.0.7977.77\\vk_swiftshader.dll that did not meet the Microsoft signing level requirements.\tError\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:56:38.021\t3089\tSignature information for another event. Match using the Correlation Id.\tInformation\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:56:38.021\t12\tProcess '\\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\chrome.exe' (PID 14924) was blocked from loading the non-Microsoft-signed binary '\\Program Files\\Google\\Chrome\\Application\\152.0.7977.77\\vk_swiftshader.dll'.\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:56:38.031\t3033\tCode Integrity determined that a process (\\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\chrome.exe) attempted to load \\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\152.0.7977.77\\vulkan-1.dll that did not meet the Microsoft signing level requirements.\tError\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:56:38.031\t3089\tSignature information for another event. Match using the Correlation Id.\tInformation\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:56:38.031\t12\tProcess '\\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\chrome.exe' (PID 14924) was blocked from loading the non-Microsoft-signed binary '\\Program Files\\Google\\Chrome\\Application\\152.0.7977.77\\vulkan-1.dll'.\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:56:38.037\t3033\tCode Integrity determined that a process (\\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\chrome.exe) attempted to load \\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\152.0.7977.77\\vulkan-1.dll that did not meet the Microsoft signing level requirements.\tError\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:56:38.037\t3089\tSignature information for another event. Match using the Correlation Id.\tInformation\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:56:38.038\t12\tProcess '\\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\chrome.exe' (PID 14924) was blocked from loading the non-Microsoft-signed binary '\\Program Files\\Google\\Chrome\\Application\\152.0.7977.77\\vulkan-1.dll'.\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:56:38.064\t6\tFrameServer FsProxy Initialization Start, SymbolicLink: \\\\?\\usb#vid_5858&pid_1004&mi_00#6&55f168&0&0000#{e5323777-f976-4f5b-9b55-b94699c46e44}\\global, Devices: 1, StreamType: MASTER.\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:56:38.079\t11\t\"FrameServer WatchdogTimer Start Event, TimerScope: FSSource, TimerScopeId: 0, WatchdogOperation: Activate, DurationToTriggerInHns: 200000000, \nSymbolicLink: .\"\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:56:38.079\t12\tFrameServer WatchdogTimer Stop Event, TimerScope: FSSource, TimerScopeId: 0, WatchdogOperation: Activate, DurationToCompletionInHns: 64.\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:56:38.079\t11\t\"FrameServer WatchdogTimer Start Event, TimerScope: FSSource, TimerScopeId: 0, WatchdogOperation: Activate, DurationToTriggerInHns: 200000000, \nSymbolicLink: .\"\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:56:38.079\t12\tFrameServer WatchdogTimer Stop Event, TimerScope: FSSource, TimerScopeId: 0, WatchdogOperation: Activate, DurationToCompletionInHns: 20.\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:56:38.081\t7\tFrameServer FsProxy Initialization Stop, SymbolicLink: \\\\?\\usb#vid_5858&pid_1004&mi_00#6&55f168&0&0000#{e5323777-f976-4f5b-9b55-b94699c46e44}\\global, Devices: 1, Streams: 1, StreamType: MASTER, hr: 0x0.\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:56:38.088\t2\tFrameServer FsProxy SetOutputType Start, PinId: 0, MediaType: FrameSize=5497558139600 (1280,720),MajorType={73646976-0000-0010-8000-00AA00389B71},FrameRate=128849018881 (30,1),PixelAspectRatio=4294967297 (1,1),InterlacedMode=2,Subtype={3231564E-0000-0010-8000-00AA00389B71}.\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:56:38.088\t3\tFrameServer FsProxy SetOutputType Stop, hr=0x0.\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:56:41.999\t3033\tCode Integrity determined that a process (\\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\chrome.exe) attempted to load \\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\152.0.7977.77\\vk_swiftshader.dll that did not meet the Microsoft signing level requirements.\tError\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:56:41.999\t3089\tSignature information for another event. Match using the Correlation Id.\tInformation\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:56:41.999\t12\tProcess '\\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\chrome.exe' (PID 14924) was blocked from loading the non-Microsoft-signed binary '\\Program Files\\Google\\Chrome\\Application\\152.0.7977.77\\vk_swiftshader.dll'.\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:56:42.028\t3033\tCode Integrity determined that a process (\\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\chrome.exe) attempted to load \\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\152.0.7977.77\\vk_swiftshader.dll that did not meet the Microsoft signing level requirements.\tError\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:56:42.028\t3089\tSignature information for another event. Match using the Correlation Id.\tInformation\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:56:42.028\t12\tProcess '\\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\chrome.exe' (PID 14924) was blocked from loading the non-Microsoft-signed binary '\\Program Files\\Google\\Chrome\\Application\\152.0.7977.77\\vk_swiftshader.dll'.\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:56:42.035\t3033\tCode Integrity determined that a process (\\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\chrome.exe) attempted to load \\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\152.0.7977.77\\vulkan-1.dll that did not meet the Microsoft signing level requirements.\tError\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:56:42.035\t3089\tSignature information for another event. Match using the Correlation Id.\tInformation\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:56:42.036\t12\tProcess '\\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\chrome.exe' (PID 14924) was blocked from loading the non-Microsoft-signed binary '\\Program Files\\Google\\Chrome\\Application\\152.0.7977.77\\vulkan-1.dll'.\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:56:42.041\t3033\tCode Integrity determined that a process (\\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\chrome.exe) attempted to load \\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\152.0.7977.77\\vulkan-1.dll that did not meet the Microsoft signing level requirements.\tError\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:56:42.041\t3089\tSignature information for another event. Match using the Correlation Id.\tInformation\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:56:42.042\t12\tProcess '\\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\chrome.exe' (PID 14924) was blocked from loading the non-Microsoft-signed binary '\\Program Files\\Google\\Chrome\\Application\\152.0.7977.77\\vulkan-1.dll'.\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:56:53.360\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:53.363\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:53.576\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:54.358\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:54.580\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:54.801\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:56.022\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:56.468\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:57.228\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:57.671\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:58.895\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:59.342\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:59.565\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:59.898\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:00.123\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:00.346\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:01.455\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:01.784\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:02.012\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:02.456\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:02.680\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:02.905\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:03.128\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:03.352\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:03.688\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:03.912\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:04.136\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:04.803\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:06.360\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:07.367\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:07.704\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:07.928\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:08.152\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:08.376\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:08.710\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:08.933\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:09.368\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:09.584\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:09.806\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:10.142\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:10.813\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:12.040\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:12.376\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:12.711\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:12.933\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:13.157\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:13.379\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:14.156\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:14.378\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:14.714\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:15.050\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:15.495\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:15.940\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:16.385\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:17.274\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:17.830\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:18.165\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:18.386\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:18.940\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:19.164\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:19.946\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:20.501\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:20.723\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:21.498\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:21.723\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:22.168\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:22.392\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:22.616\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:23.065\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:23.285\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:23.507\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:24.398\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:25.178\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:25.400\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:25.956\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:26.179\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:26.733\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:27.064\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:27.161\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2664\n\tProcess Name:\t\tC:\\Windows\\explorer.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:57:27.163\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2664\n\tProcess Name:\t\tC:\\Windows\\explorer.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:57:27.289\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:27.624\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:27.848\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:28.070\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:28.512\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:28.735\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:28.957\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:29.291\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:29.626\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:29.850\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:30.186\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:30.968\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:31.410\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:31.617\t28017\tAppResolver Scan Started.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:57:31.647\t28032\tAppResolver has parsed the visual elements manifest for a tile.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:57:31.657\t28117\tShortcut for application Word with ID Microsoft.Office.WINWORD.EXE.15 and flags 0x11 is updated in app resolver cache.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:57:31.657\t28018\tAppResolver Scan Stopped.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:57:31.659\t28019\tAppResolver Cache Committed.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:57:31.667\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:57:31.855\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:33.859\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:34.191\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:35.192\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:35.416\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:35.859\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:36.526\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:36.856\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:37.416\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:38.194\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:38.527\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:39.975\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:40.197\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:40.418\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:40.641\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:40.975\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:41.293\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:41.517\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:42.851\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:43.518\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:44.296\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:44.633\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:45.304\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:45.751\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:45.972\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:46.197\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:46.418\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:46.862\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:47.085\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:47.530\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:47.755\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:48.090\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:48.762\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:49.208\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:49.427\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:50.452\t8001\t\"Invoking license manager because license/lease polling time up: PFN A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (361)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.454\t8001\t\"ServiceBeginAcquireLicenseImpl PsmKey:A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6+App, IsSystemUsage:1\nFunction: ServiceBeginAcquireLicenseImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2304)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.455\t8002\t\"Failure Message: hr: 0x800703f0\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2324)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.455\t8001\t\"Failure Message: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp(2324)\\LicenseManager.dll!00007FFBF486A702: (caller: 00007FFBF525134D) Exception(7) tid(7a0) 800703F0 \u041f\u043e\u043f\u044b\u0442\u043a\u0430 \u0441\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u043d\u0435\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0439 \u0442\u043e\u043a\u0435\u043d.\n\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2348)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.457\t8001\t\"ServiceBeginAcquireLicenseImpl PsmKey:A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6+App, IsSystemUsage:1\nFunction: ServiceBeginAcquireLicenseImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2304)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.457\t8002\t\"Failure Message: hr: 0x800703f0\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2324)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.457\t8001\t\"Failure Message: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp(2324)\\LicenseManager.dll!00007FFBF486A702: (caller: 00007FFBF525134D) Exception(8) tid(7a0) 800703F0 \u041f\u043e\u043f\u044b\u0442\u043a\u0430 \u0441\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u043d\u0435\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0439 \u0442\u043e\u043a\u0435\u043d.\n\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2348)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.458\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:57:50.459\t8001\t\"ServiceBeginAcquireLicenseImpl PsmKey:A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6+App, IsSystemUsage:1\nFunction: ServiceBeginAcquireLicenseImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2304)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.462\t8001\t\"Skipping license manager: PFN A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.470\t8001\t\"Licensing package A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6 (3)\nFunction: OneStoreApplicationLicenseManager::GetLicenseForInstalledPackage\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\onestoreapplicensemanager.cpp (120)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.471\t8001\t\"Licensing 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A (Active)\nFunction: LicenseManager::LicenseContentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\manager.cpp (88)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.471\t8001\t\"0000021F831D3820: Key Machine for content: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\nFunction: KeyMachine::KeyMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (95)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.471\t8011\t0x21f83133e68: 13532: RootMachine: Dispatch: Root:Connect => Root:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.471\t8011\t0x21f831d3840: 13532: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A: Dispatch: Key:Activate => Key:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.471\t8001\t\"0000021F831D3820: BeginLicense: Operation 3, CachedLeaseOK true, RequireServiceValidation false\nFunction: KeyMachine::DoBeginLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (819)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.471\t8012\t0x21f831d3840: 13532: Key:Initial Change: Key:NegotiatingUnleased => 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.509\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:57:50.509\t505\t\"Compatibility fix applied to C:\\WINDOWS\\system32\\backgroundTaskHost.exe.\nFix information: \u042f\u043d\u0434\u0435\u043a\u0441.\u041c\u0443\u0437\u0438\u043a\u0430, {071f875e-406c-4938-beaa-65f69cc573e2}, 0x80010101.\"\tInformation\tMicrosoft-Windows-Application-Experience/Program-Telemetry\tMicrosoft-Windows-Application-Experience\n05.09.2026 08:57:50.509\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:57:50.532\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:50.533\t100\tClipSVC service is starting.  Caller: TriggerStarted\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 08:57:50.535\t101\tClipSVC service is running.  Version 10.0.26100.9168\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 08:57:50.545\t8001\t\"Considering License ID {DE7849EA-B8E4-60D1-C780-7B0969A99E76} for content ID 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.545\t8001\t\"Decoding: {\"\"legacyProductId\"\":\"\"b7757af6-9e6d-4d21-8272-c9137a2e9145\"\"}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.545\t8001\t\"Accepting key with License ID {DE7849EA-B8E4-60D1-C780-7B0969A99E76} for Content ID 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A (first match)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (223)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.545\t8001\t\"Returning key document for contentid 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (262)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.545\t8001\t\"Getting lease for 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\nFunction: LicenseManagerCore::GetExistingLeaseAndLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (415)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.547\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2be1da80-9d39-1a56-8b4b-dca10f958cc2\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=80daf1f6-7afc-6d23-2c3c-f1e0a663029a&entitlementId=2be1da80-9d39-1a56-8b4b-dca10f958cc2&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"de7849ea-b8e4-60d1-c780-7b0969a99e76\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"80daf1f6-7afc-6d23-2c3c-f1e0a663029a\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NBLGGH0CB6D\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-09-04T15:27:12.2174791+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.547\t8001\t\"Adding lease {941FBCC0-EC32-D9CB-EB46-FC3AE38EC79B} to results\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (387)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.547\t8001\t\"Returning 1 lease documents for contentid 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.547\t8001\t\"lease = 0x831abdd8, usage = 268435456, policy = 1, operation = 3, leaseBehavior = 0, shouldContentBeDeactivated = 0\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (905)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.547\t8011\t0x21f831d3840: 13532: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A: Dispatch: Key:@LicenseDone => Key:NegotiatingUnleased\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.554\t8001\t\"lease = 0x831abdd8, leaseActive = 1, leaseBehavior = 0\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1986)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.554\t8001\t\"Lease Machine: 0000021F8312B800: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\nFunction: LeaseMachine::LeaseMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (40)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.554\t8001\t\"Set results for lease = 0x831abdd8, policy = 1, operation = 3, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.554\t8001\t\"No cached lease or key found, not renewing with service and treating this as a valid license with lease = 0x831abdd8\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (2032)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.554\t8012\t0x21f831d3840: 13532: Key:NegotiatingUnleased Change: Key:Valid => 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.554\t8011\t0x21f831d3840: 13532: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A: Dispatch: Key:RegisterCallback => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.554\t8001\t\"Decoding: {\"\"legacyProductId\"\":\"\"b7757af6-9e6d-4d21-8272-c9137a2e9145\"\"}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.554\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2be1da80-9d39-1a56-8b4b-dca10f958cc2\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=80daf1f6-7afc-6d23-2c3c-f1e0a663029a&entitlementId=2be1da80-9d39-1a56-8b4b-dca10f958cc2&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"de7849ea-b8e4-60d1-c780-7b0969a99e76\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"80daf1f6-7afc-6d23-2c3c-f1e0a663029a\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NBLGGH0CB6D\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-09-04T15:27:12.2174791+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.554\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2be1da80-9d39-1a56-8b4b-dca10f958cc2\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=80daf1f6-7afc-6d23-2c3c-f1e0a663029a&entitlementId=2be1da80-9d39-1a56-8b4b-dca10f958cc2&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"de7849ea-b8e4-60d1-c780-7b0969a99e76\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"80daf1f6-7afc-6d23-2c3c-f1e0a663029a\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NBLGGH0CB6D\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-09-04T15:27:12.2174791+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.554\t8011\t0x21f8312b820: 8012: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}: Dispatch: Lease:UpdateLeaseDocument => Lease:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.554\t8012\t0x21f8312b820: 8012: Lease:Initial Change: Lease:Valid => {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.554\t8001\t\"ReactiveLicensingResult: 0x00000000 for A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6, 94ms\nFunction: LogReactiveLicensingResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\telemetry.cpp (512)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.555\t8001\t\"Updating lease timer for {1173A7B1-89F2-09CC-0563-CDED7D7397B9} to expire @ 2026-09-05T02:37:58Z (jitter was 40.129745 minutes)\nFunction: LeaseMachine::DoUpdateLeaseTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (276)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.555\t8001\t\"Added timer for {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\nFunction: MemoryTimerService::CreateTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (57)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.555\t8011\t0x21f8312b820: 8012: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}: Dispatch: Lease:AddKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.558\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 13796) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffb9b8c7243, module offset: 0x17243, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x152a2fdb240, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:57:50.558\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 13796) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffb9b8bfda9, module offset: 0xfda9, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x152a2fdbf00, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:57:50.558\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 13796) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffb9b8c90c3, module offset: 0x190c3, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x152a2fdbf09, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:57:50.558\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 13796) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffb9b8c06ff, module offset: 0x106ff, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x152a2fdbf28, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:57:50.558\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 13796) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffb9b8b89fd, module offset: 0x89fd, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x152a2fdbf20, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:57:50.568\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:57:50.568\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:57:50.705\t16394\tOffline downlevel migration succeeded.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 08:57:50.865\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:51.078\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:51.214\t157\tThe license with Id 2da6ca43-2e6f-1f16-05ad-a9959043ddb7 has been archived successfully.  PFM if available: Microsoft.Windows.99.X20-15863_8wekyb3d8bbwe\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 08:57:51.214\t116\t\"Application license successfully installed.\nPackage: Microsoft.Windows.99.X20-15863_8wekyb3d8bbwe\nUser Id (if available): NULL\nLicense Id: 2da6ca43-2e6f-1f16-05ad-a9959043ddb7\nAssociate Id: 2da6ca43-2e6f-1f16-05ad-a9959043ddb7\"\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 08:57:51.222\t8001\t\"Licensing content 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: OneStoreApplicationLicenseManager::ActivateLicenseForContent\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\onestoreapplicensemanager.cpp (410)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.222\t8001\t\"Licensing 807d73a3-33f2-c21b-c47a-85c313d97af9 (Active)\nFunction: LicenseManager::LicenseContentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\manager.cpp (88)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.222\t8002\t\"Capturing identity for LocalSystem, this probably isn't intended\nFunction: StoredIdentity::StoredIdentity\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\identity.cpp (536)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.222\t8001\t\"0000021F831D31E0: Key Machine for content: 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: KeyMachine::KeyMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (95)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.222\t8011\t0x21f83133e68: 8012: RootMachine: Dispatch: Root:Connect => Root:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.223\t8011\t0x21f831d3200: 8012: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:Activate => Key:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.223\t8001\t\"0000021F831D31E0: BeginLicense: Operation 3, CachedLeaseOK true, RequireServiceValidation false\nFunction: KeyMachine::DoBeginLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (819)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.223\t8012\t0x21f831d3200: 8012: Key:Initial Change: Key:NegotiatingUnleased => 807d73a3-33f2-c21b-c47a-85c313d97af9\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.225\t8001\t\"Considering License ID {2DA6CA43-2E6F-1F16-05AD-A9959043DDB7} for content ID 807d73a3-33f2-c21b-c47a-85c313d97af9...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.225\t8001\t\"Accepting key with License ID {2DA6CA43-2E6F-1F16-05AD-A9959043DDB7} for Content ID 807d73a3-33f2-c21b-c47a-85c313d97af9 (first match)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (223)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.225\t8001\t\"Considering License ID {8CB56148-398C-A7C4-98F2-6FDC89C2093D} for content ID 807d73a3-33f2-c21b-c47a-85c313d97af9...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.225\t8001\t\"Ignoring key for 807d73a3-33f2-c21b-c47a-85c313d97af9 with quality fffffff (0xc0ea0009) (no better than best)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (251)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.225\t8001\t\"Considering License ID {BDBB3CA5-594E-7337-A093-A9860F553465} for content ID 807d73a3-33f2-c21b-c47a-85c313d97af9...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.225\t8001\t\"Decoding: {}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.225\t8001\t\"Accepting key with License ID {BDBB3CA5-594E-7337-A093-A9860F553465} for Content ID 807d73a3-33f2-c21b-c47a-85c313d97af9 (better quality: 7f000000 vs 1fffffff)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (229)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.225\t8001\t\"Returning key document for contentid 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (262)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.225\t8001\t\"Getting lease for 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: LicenseManagerCore::GetExistingLeaseAndLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (415)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.230\t8001\t\"Ignoring otherwise matching lease ({33B013F2-4858-241D-9000-CA9374B3ADB5}) for Content ID 807D73A3-33F2-C21B-C47A-85C313D97AF9 because of quality 268435455 (0xc0ea000a)\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (396)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.230\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.230\t8001\t\"Adding lease {AE9143F3-8179-89B2-A3AF-FFC1D366D1AE} to results\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (387)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.230\t8001\t\"Returning 1 lease documents for contentid 807D73A3-33F2-C21B-C47A-85C313D97AF9\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.230\t8001\t\"lease = 0x831ab8c8, usage = 536870912, policy = 2147483647, operation = 3, leaseBehavior = 0, shouldContentBeDeactivated = 0\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (905)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.230\t8001\t\"lease = 0x831ab8c8, quality = 1073741824\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (935)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.230\t8001\t\"content is alreadyLicensed, lease is cached\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (942)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.230\t8011\t0x21f831d3200: 8012: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:@LicenseDone => Key:NegotiatingUnleased\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.232\t8002\t\"Failure Message: hr: 0x80070490\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\misc.cpp (49)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.232\t8001\t\"lease = 0x831ab8c8, leaseActive = 1, leaseBehavior = 0\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1986)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.232\t8001\t\"Lease Machine: 0000021F8312A800: {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: LeaseMachine::LeaseMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (40)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.232\t8001\t\"Set results for lease = 0x831ab8c8, policy = 2147483647, operation = 3, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.232\t8001\t\"No cached lease or key found, not renewing with service and treating this as a valid license with lease = 0x831ab8c8\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (2032)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.232\t8012\t0x21f831d3200: 8012: Key:NegotiatingUnleased Change: Key:Valid => 807d73a3-33f2-c21b-c47a-85c313d97af9\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.232\t8011\t0x21f8312a820: 8012: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:UpdateLeaseDocument => Lease:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.232\t8012\t0x21f8312a820: 8012: Lease:Initial Change: Lease:Valid => {2CE050AC-4159-AABB-AC60-9CED070AF672}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.232\t8001\t\"Decoding: {}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.232\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.232\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.232\t8011\t0x21f831d3200: 2976: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:RegisterCallback => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.233\t8011\t0x21f831d3200: 13532: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:Unregistered => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.233\t8001\t\"Lease dropped\nFunction: KeyMachine::DoDropLease\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (279)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.233\t8012\t0x21f831d3200: 13532: Key:Valid Change: Key:Invalid => 807d73a3-33f2-c21b-c47a-85c313d97af9\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.233\t8001\t\"Set results for lease = 0x0, policy = 0, operation = 0, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.233\t8001\t\"Updating lease timer for {2CE050AC-4159-AABB-AC60-9CED070AF672} to expire @ 2026-09-11T13:58:38Z (jitter was 34.034996 minutes)\nFunction: LeaseMachine::DoUpdateLeaseTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (276)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.233\t8001\t\"Added timer for {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: MemoryTimerService::CreateTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (57)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.233\t8011\t0x21f8312a820: 8012: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:AddKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.233\t8011\t0x21f8312a820: 8012: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:RemoveKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.233\t8011\t0x21f8312a820: 8012: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:Unregistered => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.233\t8012\t0x21f8312a820: 8012: Lease:Valid Change: Lease:Invalid => {2CE050AC-4159-AABB-AC60-9CED070AF672}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.233\t8001\t\"Requesting lease document removal for reason 0x00000000, {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: LicenseManagerCore::DoRemoveLeaseDocumentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (1460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.233\t173\tProduct key from MSDM table redeemed. Result: 0x0\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 08:57:51.234\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.234\t8001\t\"Ignoring lease removal with reason 0x00000000 because this is an offline lease\n\nFunction: ClipStorage::RemoveLeaseDocumentWithIdAndReason\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (501)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.234\t8002\t\"Trying to remove timer {2CE050AC-4159-AABB-AC60-9CED070AF672} not in table\nFunction: MemoryTimerService::CancelTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (80)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.234\t8001\t\"Removed timer for {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: MemoryTimerService::CleanupTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (19)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.303\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:51.523\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:52.171\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:52.386\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:52.397\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:52.404\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:59.346\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:57:59.346\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:57:59.366\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:57:59.366\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:58:08.142\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:58:08.142\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:58:08.142\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:58:08.156\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:58:09.240\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:09.246\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:09.460\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:09.671\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:09.883\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:10.106\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:10.332\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:10.551\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:10.993\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:11.214\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:11.547\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:12.323\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:13.437\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:14.439\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:14.662\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:14.885\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:15.107\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:15.329\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:16.104\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:16.888\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:17.112\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:17.336\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:17.559\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:17.781\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:17.999\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:18.222\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:18.667\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:19.670\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:19.891\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:20.225\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:20.448\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:20.672\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:20.894\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:20.926\t16384\tSuccessfully scheduled Software Protection service for re-start at 2126-08-12T01:58:20Z. Reason: RulesEngine.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 08:58:21.105\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:21.886\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:22.443\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:22.666\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:22.913\t21\tSound level for application [Microsoft.ZuneMusic_8wekyb3d8bbwe!Microsoft.ZuneMusic] changed to [0]\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 08:58:22.995\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:23.005\t22\tSuspended: true\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 08:58:23.005\t23\t\"Released exclusive mode resource false\nReleased offload mode resource true\"\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 08:58:23.328\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:23.550\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:23.773\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:23.995\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:24.218\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:25.660\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:25.995\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:26.331\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:26.554\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:27.560\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:27.782\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:28.559\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:28.782\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:29.117\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:29.338\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:29.784\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:30.341\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:30.564\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:30.770\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:31.548\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:32.106\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:32.661\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:32.872\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:33.089\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:33.312\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:33.534\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:33.756\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:34.202\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:34.424\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:34.649\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:34.982\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:35.426\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:35.981\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:36.203\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:36.648\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:37.315\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:37.650\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:37.871\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:38.077\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:38.401\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:38.622\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:38.955\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:39.176\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:39.624\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:40.178\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:40.954\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:41.179\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:41.725\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:41.948\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:42.168\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:42.391\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:42.725\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:42.946\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:43.502\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:44.721\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:46.056\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:46.392\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:46.950\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:47.284\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:48.062\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:48.286\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:49.516\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:49.740\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:50.076\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:50.609\t8001\t\"Invoking license manager because license/lease polling time up: PFN A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (361)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:58:50.609\t8001\t\"ServicePackageRundownNotificationImpl PsmKey:A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6+App, sid:S-1-5-21-3712849175-2219398513-4278588552-1006\nFunction: ServicePackageRundownNotificationImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2587)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:58:50.609\t8011\t0x21f831d3840: 2976: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A: Dispatch: Key:Unregistered => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:58:50.609\t8001\t\"Lease dropped\nFunction: KeyMachine::DoDropLease\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (279)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:58:50.609\t8012\t0x21f831d3840: 2976: Key:Valid Change: Key:Invalid => 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:58:50.609\t8011\t0x21f8312b820: 8012: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}: Dispatch: Lease:RemoveKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:58:50.609\t8011\t0x21f8312b820: 8012: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}: Dispatch: Lease:Unregistered => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:58:50.609\t8001\t\"Set results for lease = 0x0, policy = 0, operation = 0, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:58:50.609\t8012\t0x21f8312b820: 8012: Lease:Valid Change: Lease:Invalid => {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:58:50.609\t8001\t\"Requesting lease document removal for reason 0x00000000, {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\nFunction: LicenseManagerCore::DoRemoveLeaseDocumentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (1460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:58:50.611\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2be1da80-9d39-1a56-8b4b-dca10f958cc2\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=80daf1f6-7afc-6d23-2c3c-f1e0a663029a&entitlementId=2be1da80-9d39-1a56-8b4b-dca10f958cc2&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"de7849ea-b8e4-60d1-c780-7b0969a99e76\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"80daf1f6-7afc-6d23-2c3c-f1e0a663029a\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NBLGGH0CB6D\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-09-04T15:27:12.2174791+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:58:50.611\t8001\t\"Ignoring lease removal with reason 0x00000000 because this is an offline lease\n\nFunction: ClipStorage::RemoveLeaseDocumentWithIdAndReason\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (501)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:58:50.611\t8002\t\"Trying to remove timer {1173A7B1-89F2-09CC-0563-CDED7D7397B9} not in table\nFunction: MemoryTimerService::CancelTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (80)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:58:50.611\t8001\t\"Removed timer for {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\nFunction: MemoryTimerService::CleanupTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (19)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:58:50.636\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:50.972\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:51.306\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:52.416\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:52.637\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:52.972\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:53.307\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:53.976\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:54.201\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:54.537\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:54.869\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:55.091\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:55.314\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:56.092\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:56.539\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:57.204\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:57.981\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:58.204\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:59.100\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:59.108\t210\tCreated Desktop AppX container {245CDE03-A8C9-11F1-B7FF-289200F24A99} for package MonitorManage_1.0.0.1_neutral__s7rhbyg9f8xr8.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:58:59.108\t211\tAdded process 15536 to Desktop AppX container 245cde03-a8c9-11f1-b7ff-289200f24a99 for package MonitorManage_1.0.0.1_neutral__s7rhbyg9f8xr8.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:58:59.147\t8001\t\"Skipping license manager: PFN Microsoft.WindowsTerminal_1.24.11911.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:58:59.172\t210\tCreated Desktop AppX container {245CDE08-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.WindowsTerminal_1.24.11911.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:58:59.172\t211\tAdded process 5392 to Desktop AppX container 245cde08-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.WindowsTerminal_1.24.11911.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:58:59.660\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:59.886\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:00.107\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:00.330\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:00.664\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:01.107\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:01.444\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:01.890\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:02.445\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:02.450\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"explorer\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:04.164\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:59:04.164\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:59:04.181\t4116\tStarted the Group Policy service initialization phase.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:59:04.184\t4115\tGroup Policy Service started.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:59:04.184\t5324\tGroup Policy received the notification CreateSession from Winlogon for session 0.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:59:04.184\t5351\tGroup policy session returned to winlogon.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:59:04.185\t4117\tGroup Policy Session started.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:59:04.187\t5351\tGroup policy session returned to winlogon.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:59:04.188\t4117\tGroup Policy Session started.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:59:04.189\t5116\tSuccessfully completed the Group Policy Service initialization phase.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:59:04.190\t5320\tThe Group Policy Client service is currently configured as a standalone service.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:59:04.190\t5320\tInitializing and reading current service configuration for the Group Policy Client service.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:59:04.190\t5320\tInitializing service instance state to detect previous instances of the service.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:59:04.190\t5321\tA previous instance of the Group Policy Client Service was detected. Parameter: 617633a1-9144-4ef0-bf9e-2368ace073ed\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:59:04.190\t5117\tGroup policy session completed successfully.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:59:04.191\t5117\tGroup policy session completed successfully.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:59:04.546\t27\tConnection state - All connections have succeeded since the previous period.\tInformation\tMicrosoft-Windows-UniversalTelemetryClient/Operational\tMicrosoft-Windows-UniversalTelemetryClient\n05.09.2026 08:59:10.188\t1005\tThe Connection Provider status changed to Disconnected.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:10.188\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:10.188\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:10.190\t1005\tThe Connection Provider status changed to Disconnected.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:10.190\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:10.190\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:10.207\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:10.207\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:10.215\t1113\tDevice Compact Ticket request completed with Device Id 00180018E4F8342E for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:10.231\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:10.235\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:10.235\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:17.832\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:17.838\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:18.610\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:18.845\t217\tDestroyed Desktop AppX container {245CDE08-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.WindowsTerminal_1.24.11911.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:59:18.849\t217\tDestroyed Desktop AppX container {245CDE03-A8C9-11F1-B7FF-289200F24A99} for package MonitorManage_1.0.0.1_neutral__s7rhbyg9f8xr8.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:59:18.947\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:19.010\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:19.010\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:19.011\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:19.011\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:19.282\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:19.505\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:19.575\t505\t\"Compatibility fix applied to C:\\WINDOWS\\system32\\backgroundTaskHost.exe.\nFix information: Microsoft Apps, {81ecdb97-5112-41af-9a59-5ba9444f4270}, 0x80010101.\"\tInformation\tMicrosoft-Windows-Application-Experience/Program-Telemetry\tMicrosoft-Windows-Application-Experience\n05.09.2026 08:59:19.726\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:20.037\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:20.043\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"WINWORD\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:21.922\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:21.925\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:22.370\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:23.592\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:23.926\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:24.483\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:24.817\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:24.827\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:24.832\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"WINWORD\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:27.778\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:27.778\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:27.778\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:27.786\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:35.197\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, WMIProv, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:59:38.471\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:38.475\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:39.140\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:39.587\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:39.811\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:40.145\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:40.590\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:40.923\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:41.370\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:41.700\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:41.923\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:42.154\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:42.372\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:42.376\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:42.381\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"explorer\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:44.820\t8001\t\"Skipping license manager: PFN Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:59:44.837\t210\tCreated Desktop AppX container {245CDE44-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:59:44.837\t211\tAdded process 4704 to Desktop AppX container 245cde44-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:59:44.899\t8001\t\"Skipping license manager: PFN SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:59:44.920\t16\tThe access history in hive \\??\\C:\\Users\\admin\\AppData\\Local\\Packages\\SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_wyx1vj98g3asy\\SystemAppData\\Helium\\User.dat was cleared updating 1 keys and creating 1 modified pages.\tInformation\tSystem\tMicrosoft-Windows-Kernel-General\n05.09.2026 08:59:44.921\t16\tThe access history in hive \\??\\C:\\Users\\admin\\AppData\\Local\\Packages\\SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_wyx1vj98g3asy\\SystemAppData\\Helium\\UserClasses.dat was cleared updating 1 keys and creating 1 modified pages.\tInformation\tSystem\tMicrosoft-Windows-Kernel-General\n05.09.2026 08:59:44.922\t16\tThe access history in hive \\??\\C:\\ProgramData\\Packages\\SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_wyx1vj98g3asy\\S-1-5-21-3712849175-2219398513-4278588552-1006\\SystemAppData\\Helium\\Cache\\446d4697ac2953bf_COM15.dat was cleared updating 1 keys and creating 1 modified pages.\tInformation\tSystem\tMicrosoft-Windows-Kernel-General\n05.09.2026 08:59:44.925\t210\tCreated Desktop AppX container {245CDE49-A8C9-11F1-B7FF-289200F24A99} for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:59:44.925\t211\tAdded process 9300 to Desktop AppX container 245cde49-a8c9-11f1-b7ff-289200f24a99 for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:59:44.980\t210\tCreated Desktop AppX container {245CDE4E-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:59:44.980\t211\tAdded process 11556 to Desktop AppX container 245cde4e-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:59:55.484\t28017\tAppResolver Scan Started.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:59:55.508\t28032\tAppResolver has parsed the visual elements manifest for a tile.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:59:55.510\t28115\tShortcut for application WINWORD.EXE - Shortcut with ID Microsoft.Office.WINWORD.EXE.15 and flags 0x10 is added to app resolver cache.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:59:55.514\t28018\tAppResolver Scan Stopped.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:59:55.517\t28019\tAppResolver Cache Committed.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:59:55.525\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:58.529\t217\tDestroyed Desktop AppX container {245CDE4E-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:59:58.530\t217\tDestroyed Desktop AppX container {245CDE44-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:59:58.543\t8001\t\"Invoking license manager because license/lease polling time up: PFN SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (361)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:59:58.544\t8001\t\"ServicePackageRundownNotificationImpl PsmKey:SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy+App, sid:S-1-5-21-3712849175-2219398513-4278588552-1006\nFunction: ServicePackageRundownNotificationImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2587)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:59:58.549\t217\tDestroyed Desktop AppX container {245CDE49-A8C9-11F1-B7FF-289200F24A99} for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:59:59.305\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:59.309\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:59.635\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:59.858\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:00.191\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:00.414\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:00.636\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:00.859\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:01.080\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:01.303\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:01.747\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:01.914\t8001\t\"Skipping license manager: PFN Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:00:01.937\t210\tCreated Desktop AppX container {245CDE56-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:01.937\t211\tAdded process 3380 to Desktop AppX container 245cde56-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:01.971\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:01.995\t8001\t\"Skipping license manager: PFN SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:00:02.021\t210\tCreated Desktop AppX container {245CDE5B-A8C9-11F1-B7FF-289200F24A99} for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:02.021\t211\tAdded process 7048 to Desktop AppX container 245cde5b-a8c9-11f1-b7ff-289200f24a99 for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:02.065\t210\tCreated Desktop AppX container {245CDE60-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:02.065\t211\tAdded process 13176 to Desktop AppX container 245cde60-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:02.303\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:02.843\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:03.286\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:03.306\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:03.310\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"explorer\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:05.590\t8100\tStarting validation and setting the Trust Label on package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:00:05.591\t8106\tPackage Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe has Trust Label already. Flags: 0x103\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:00:05.591\t8101\tFinished validation and setting the Trust Label on package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:00:07.175\t217\tDestroyed Desktop AppX container {245CDE60-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:11.312\t210\tCreated Desktop AppX container {245CDE65-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:11.312\t211\tAdded process 5628 to Desktop AppX container 245cde65-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:16.928\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:16.932\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:17.145\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:17.274\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:00:17.274\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:00:18.366\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:19.365\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:20.147\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:20.371\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:20.820\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:21.044\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:21.603\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:21.939\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:22.274\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:22.943\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:24.618\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:24.839\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:25.061\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:25.395\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:25.856\t217\tDestroyed Desktop AppX container {245CDE65-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:25.955\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:26.180\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:26.403\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:26.959\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:27.514\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:27.736\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:29.076\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:29.523\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:29.857\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:30.079\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:30.526\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:30.565\t217\tDestroyed Desktop AppX container {245CDE56-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:30.565\t217\tDestroyed Desktop AppX container {245CDE5B-A8C9-11F1-B7FF-289200F24A99} for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:30.567\t8001\t\"Invoking license manager because license/lease polling time up: PFN SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (361)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:00:30.567\t8001\t\"ServicePackageRundownNotificationImpl PsmKey:SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy+App, sid:S-1-5-21-3712849175-2219398513-4278588552-1006\nFunction: ServicePackageRundownNotificationImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2587)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:00:31.307\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:31.863\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:32.197\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:32.419\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:33.091\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:33.315\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:33.647\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:34.204\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:34.763\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:34.987\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:35.650\t8001\t\"Skipping license manager: PFN Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:00:35.666\t210\tCreated Desktop AppX container {245CDE6F-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:35.666\t211\tAdded process 3232 to Desktop AppX container 245cde6f-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:35.723\t8001\t\"Skipping license manager: PFN SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:00:35.750\t210\tCreated Desktop AppX container {245CDE74-A8C9-11F1-B7FF-289200F24A99} for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:35.750\t211\tAdded process 2020 to Desktop AppX container 245cde74-a8c9-11f1-b7ff-289200f24a99 for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:35.797\t210\tCreated Desktop AppX container {245CDE79-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:35.797\t211\tAdded process 6128 to Desktop AppX container 245cde79-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:35.987\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:36.770\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:36.775\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"explorer\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:43.342\t2416\tA local notification was received from MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets [AppUserModelId] with a 0 [NotificationId] through an application endpoint.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:00:43.345\t2418\tA local notification was submitted to threadpool: MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets [AppUserModelId] tile [NotificationType] 9401 [NotificationTrackingId] Local [NotificationSource].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:00:45.538\t28017\tAppResolver Scan Started.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:00:45.563\t28032\tAppResolver has parsed the visual elements manifest for a tile.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:00:45.565\t28115\tShortcut for application WINWORD.EXE - Shortcut (2) with ID Microsoft.Office.WINWORD.EXE.15 and flags 0x10 is added to app resolver cache.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:00:45.569\t28018\tAppResolver Scan Stopped.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:00:45.572\t28019\tAppResolver Cache Committed.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:00:45.579\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:00:48.559\t217\tDestroyed Desktop AppX container {245CDE79-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:48.560\t217\tDestroyed Desktop AppX container {245CDE6F-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:48.572\t8001\t\"Invoking license manager because license/lease polling time up: PFN SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (361)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:00:48.572\t8001\t\"ServicePackageRundownNotificationImpl PsmKey:SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy+App, sid:S-1-5-21-3712849175-2219398513-4278588552-1006\nFunction: ServicePackageRundownNotificationImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2587)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:00:48.573\t217\tDestroyed Desktop AppX container {245CDE74-A8C9-11F1-B7FF-289200F24A99} for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:52.072\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:52.076\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:52.515\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:53.524\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:53.968\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:54.514\t8001\t\"Skipping license manager: PFN Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:00:54.526\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:54.530\t210\tCreated Desktop AppX container {245CDE80-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:54.531\t211\tAdded process 3188 to Desktop AppX container 245cde80-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:54.586\t8001\t\"Skipping license manager: PFN SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:00:54.612\t210\tCreated Desktop AppX container {245CDE85-A8C9-11F1-B7FF-289200F24A99} for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:54.612\t211\tAdded process 15532 to Desktop AppX container 245cde85-a8c9-11f1-b7ff-289200f24a99 for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:54.659\t210\tCreated Desktop AppX container {245CDE8A-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:54.659\t211\tAdded process 9584 to Desktop AppX container 245cde8a-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:55.528\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:55.738\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:55.742\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"explorer\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:59.771\t217\tDestroyed Desktop AppX container {245CDE8A-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:01:00.851\t210\tCreated Desktop AppX container {245CDE8F-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:01:00.852\t211\tAdded process 8468 to Desktop AppX container 245cde8f-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:01:00.864\t28017\tAppResolver Scan Started.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:01:00.890\t28018\tAppResolver Scan Stopped.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:01:00.892\t28019\tAppResolver Cache Committed.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:01:00.897\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:01:05.996\t217\tDestroyed Desktop AppX container {245CDE8F-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:01:12.701\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:12.704\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:13.027\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:13.472\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:13.694\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:13.734\t217\tDestroyed Desktop AppX container {245CDE80-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:01:13.740\t217\tDestroyed Desktop AppX container {245CDE85-A8C9-11F1-B7FF-289200F24A99} for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:01:13.741\t8001\t\"Invoking license manager because license/lease polling time up: PFN SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (361)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:01:13.742\t8001\t\"ServicePackageRundownNotificationImpl PsmKey:SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy+App, sid:S-1-5-21-3712849175-2219398513-4278588552-1006\nFunction: ServicePackageRundownNotificationImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2587)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:01:14.251\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:14.585\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:15.141\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:15.363\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:16.036\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:16.111\t8001\t\"Skipping license manager: PFN Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:01:16.132\t210\tCreated Desktop AppX container {245CDE94-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:01:16.132\t211\tAdded process 9136 to Desktop AppX container 245cde94-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:01:16.188\t8001\t\"Skipping license manager: PFN SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:01:16.213\t210\tCreated Desktop AppX container {245CDE99-A8C9-11F1-B7FF-289200F24A99} for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:01:16.213\t211\tAdded process 16140 to Desktop AppX container 245cde99-a8c9-11f1-b7ff-289200f24a99 for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:01:16.259\t210\tCreated Desktop AppX container {245CDE9E-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:01:16.259\t211\tAdded process 6036 to Desktop AppX container 245cde9e-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:01:16.482\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:16.705\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:16.926\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:17.371\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:17.701\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:17.704\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"explorer\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:21.375\t217\tDestroyed Desktop AppX container {245CDE9E-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:01:21.585\t210\tCreated Desktop AppX container {245CDEA3-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:01:21.585\t211\tAdded process 16184 to Desktop AppX container 245cdea3-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:01:30.684\t300\tCompositor Type: 1WINWORDP1: %3P2: %4P3: %5P4: %6\tInformation\tOAlerts\tMicrosoft Office 16 Alerts\n05.09.2026 09:01:31.355\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:31.360\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:31.794\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:32.349\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:33.017\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:33.080\t28017\tAppResolver Scan Started.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:01:33.105\t28032\tAppResolver has parsed the visual elements manifest for a tile.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:01:33.107\t28117\tShortcut for application WINWORD.EXE - Shortcut with ID Microsoft.Office.WINWORD.EXE.15 and flags 0x10 is updated in app resolver cache.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:01:33.112\t28018\tAppResolver Scan Stopped.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:01:33.115\t28019\tAppResolver Cache Committed.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:01:33.121\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:01:33.910\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:34.242\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:35.020\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:35.244\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:35.467\t217\tDestroyed Desktop AppX container {245CDE94-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:01:35.624\t217\tDestroyed Desktop AppX container {245CDEA3-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:01:35.630\t8001\t\"Invoking license manager because license/lease polling time up: PFN SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (361)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:01:35.631\t8001\t\"ServicePackageRundownNotificationImpl PsmKey:SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy+App, sid:S-1-5-21-3712849175-2219398513-4278588552-1006\nFunction: ServicePackageRundownNotificationImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2587)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:01:35.631\t217\tDestroyed Desktop AppX container {245CDE99-A8C9-11F1-B7FF-289200F24A99} for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:01:35.803\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:36.470\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:36.693\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:36.917\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:37.923\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:38.259\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:38.707\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:38.929\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:39.150\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:40.484\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:41.039\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:41.485\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:42.380\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:42.603\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:42.826\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:43.044\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:43.376\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:43.600\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:43.822\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:44.046\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:45.043\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:45.254\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:45.468\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:45.672\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:45.884\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:47.195\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:47.416\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:47.633\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:47.848\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:47.854\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:47.860\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:04.709\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:04.714\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:04.924\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:06.367\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:07.157\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:07.371\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:07.584\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:08.022\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:08.335\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:08.661\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:08.877\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:09.094\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:09.310\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:09.531\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:10.305\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:10.649\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:11.302\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:11.740\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:11.956\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:12.180\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:12.392\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:12.605\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:12.817\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:13.476\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:13.803\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:14.019\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:14.242\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:14.461\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:14.676\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:14.895\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:15.114\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:15.322\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:15.532\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:15.866\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:16.074\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:16.301\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:16.519\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:16.842\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:17.057\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:17.271\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:17.487\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:17.705\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:17.926\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:18.143\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:18.361\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:18.575\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:18.790\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:19.124\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:19.343\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:19.556\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:19.891\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:20.109\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:20.321\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:20.539\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:20.756\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:21.634\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:21.852\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:22.061\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:22.395\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:22.612\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:22.836\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:23.045\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:23.257\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:23.475\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:23.694\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:24.240\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:24.450\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:24.887\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:25.104\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:25.425\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:25.644\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:25.860\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:26.084\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:26.294\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:26.507\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:26.724\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:27.051\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:27.377\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:27.593\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:27.811\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:28.029\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:28.678\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:29.011\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:29.225\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:29.440\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:29.657\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:29.860\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:30.408\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:30.735\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:30.952\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:31.153\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:31.362\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:31.580\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:31.909\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:32.123\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:32.439\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:32.652\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:32.857\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:33.073\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:33.283\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:33.500\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:33.717\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:33.930\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:34.365\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:34.582\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:34.807\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:35.136\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:35.353\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:35.794\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:36.014\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:36.231\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:36.439\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:36.770\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:36.979\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:37.198\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:37.420\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:37.752\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:38.072\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:38.281\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:38.498\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:38.709\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:39.034\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:39.251\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:39.464\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:39.674\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:39.682\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:56.202\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:56.205\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:56.532\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:56.747\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:56.965\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:57.181\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:57.392\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:57.594\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:57.812\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:58.131\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:58.353\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:58.687\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:59.008\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:59.327\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:59.551\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:59.764\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:59.990\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:00.203\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:00.419\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:00.643\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:00.867\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:01.194\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:01.513\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:01.725\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:01.934\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:02.153\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:02.372\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:02.588\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:03.135\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:03.344\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:03.562\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:03.896\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:04.112\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:04.322\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:04.537\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:05.085\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:05.299\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:05.740\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:05.960\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:06.279\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:06.495\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:06.711\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:06.927\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:07.143\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:07.360\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:07.577\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:07.905\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:08.226\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:08.451\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:08.667\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:08.872\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:09.083\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:09.305\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:09.522\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:09.741\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:09.957\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:09.971\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:09.979\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:26.501\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:26.504\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:26.944\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:27.162\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:27.381\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:27.813\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:28.025\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:28.245\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:28.456\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:28.663\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:28.883\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:29.209\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:29.419\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:29.628\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:29.842\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:30.058\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:30.601\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:30.821\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:31.033\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:31.250\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:31.467\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:31.790\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:32.008\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:32.226\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:32.435\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:32.644\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:32.854\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:33.073\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:33.292\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:33.513\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:33.729\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:33.948\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:34.166\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:34.710\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:34.926\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:35.142\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:35.355\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:35.572\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:35.789\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:36.002\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:36.217\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:36.439\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:36.659\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:36.876\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:37.095\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:37.310\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:37.522\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:37.740\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:37.957\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:38.280\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:38.493\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:38.711\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:38.930\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:39.149\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:39.358\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:39.581\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:39.798\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:40.014\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:40.226\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:40.437\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:40.768\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:40.987\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:41.201\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:41.419\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:41.640\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:41.859\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:42.069\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:42.288\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:42.506\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:42.837\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:43.055\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:43.382\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:43.607\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:43.941\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:44.270\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:44.488\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:44.699\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:44.916\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:45.135\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:45.783\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:46.108\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:46.317\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:46.533\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:46.752\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:46.961\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:47.178\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:47.391\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:47.609\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:47.834\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:48.054\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:48.269\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:48.475\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:48.696\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:48.917\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:49.132\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:49.354\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:49.677\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:49.884\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:50.548\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:50.613\t102\tClipSVC service has shutdown.\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 09:03:50.865\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:51.082\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:51.299\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:51.513\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:51.732\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:51.952\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:52.173\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:52.385\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:52.820\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:53.025\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:53.467\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:53.679\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:53.890\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:54.106\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:54.646\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:54.860\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:55.416\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:55.956\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:56.170\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:56.500\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:56.826\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:57.045\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:57.253\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:57.472\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:57.688\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:57.900\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:58.223\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:58.765\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:59.078\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:59.290\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:59.501\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:59.719\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:00.154\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:00.590\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:00.806\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:01.356\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:01.580\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:01.899\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:02.222\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:02.550\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:02.769\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:02.990\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:03.428\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:03.646\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:03.859\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:03.872\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:03.878\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:23.483\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:23.486\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:23.703\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:23.917\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:24.130\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:24.344\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:24.565\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:24.892\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:25.111\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:25.330\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:25.558\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:25.881\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:26.098\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:26.423\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:26.754\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:27.405\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:27.624\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:27.948\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:28.166\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:28.383\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:28.604\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:28.814\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:29.476\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:29.675\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:29.886\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:30.110\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:30.326\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:30.534\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:30.746\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:30.966\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:31.182\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:31.406\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:31.734\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:31.963\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:32.168\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:32.484\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:32.698\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:32.917\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:33.139\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:33.465\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:33.673\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:33.888\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:34.107\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:34.325\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:34.986\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:35.201\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:35.413\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:35.741\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:36.068\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:36.277\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:36.605\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:36.822\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:37.041\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:37.262\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:37.477\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:37.699\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:37.918\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:38.123\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:38.344\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:38.563\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:38.780\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:38.998\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:39.216\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:39.440\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:39.660\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:39.883\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:40.100\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:40.319\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:40.530\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:40.754\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:40.966\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:41.180\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:41.399\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:41.727\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:41.944\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:42.167\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:42.502\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:42.725\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:42.935\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:43.265\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:43.490\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:43.708\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:44.357\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:44.898\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:45.118\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:45.338\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:45.560\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:45.783\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:46.003\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:46.330\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:46.655\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:46.873\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:47.092\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:47.302\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:47.525\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:47.744\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:47.965\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:48.175\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:48.490\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:48.709\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:48.922\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:49.257\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:49.698\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:49.912\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:50.125\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:50.342\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:50.347\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:03.585\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:03.588\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:03.806\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:04.023\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:04.240\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:04.679\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:04.898\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:05.119\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:05.334\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:05.880\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:06.089\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:06.302\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:06.623\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:06.843\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:07.287\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:07.831\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:08.270\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:08.598\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:08.926\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:09.365\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:09.578\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:09.899\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:10.443\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:10.665\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:10.884\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:11.101\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:11.321\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:11.875\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:12.094\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:12.313\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:12.531\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:12.739\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:12.956\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:13.284\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:13.501\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:13.817\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:14.147\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:14.365\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:14.582\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:14.800\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:15.128\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:15.455\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:15.668\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:16.103\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:16.326\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:16.539\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:16.871\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:17.415\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:17.625\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:18.168\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:18.386\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:18.720\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:18.932\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:19.150\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:19.372\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:19.588\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:19.803\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:20.021\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:20.559\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:20.779\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:20.994\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:21.197\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:21.410\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:21.630\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:21.958\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:22.170\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:22.494\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:22.718\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:23.153\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:23.373\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:23.587\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:23.805\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:24.137\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:24.358\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:24.581\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:24.793\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:25.108\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:25.328\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:25.540\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:25.755\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:25.969\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:26.184\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:26.392\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:26.608\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:26.818\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:27.150\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:27.368\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:27.592\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:27.816\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:28.036\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:28.367\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:28.704\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:28.926\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:29.156\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:29.369\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:29.580\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:30.556\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:30.769\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:30.984\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:31.202\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:31.417\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:31.751\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:31.758\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:44.986\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:44.990\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:45.205\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:45.424\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:46.311\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:46.530\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:46.739\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:46.954\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:47.169\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:47.497\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:47.928\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:48.482\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:48.920\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:48.924\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:01.915\t211\tAdded process 6468 to Desktop AppX container 245cdaf2-a8c9-11f1-b7ff-289200f24a99 for package MicrosoftWindows.Client.CBS_1000.26100.344.0_x64__cw5n1h2txyewy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:06:03.719\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:03.724\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:04.164\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:04.378\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:04.698\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:04.916\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:05.897\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:06.121\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:06.331\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:06.550\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:06.761\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:07.083\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:07.302\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:07.633\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:07.855\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:08.072\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:08.503\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:08.725\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:09.376\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:09.596\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:10.142\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:10.355\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:10.572\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:10.783\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:11.000\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:11.430\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:11.643\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:11.974\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:12.193\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:12.518\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:12.837\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:13.056\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:13.276\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:13.493\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:14.257\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:14.474\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:14.688\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:14.904\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:15.117\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:15.334\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:15.567\t8001\t\"Skipping license manager: PFN Microsoft.WindowsFeedbackHub_2.2606.702.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:06:15.569\t8001\t\"Skipping license manager: PFN Microsoft.WindowsFeedbackHub_2.2606.702.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:06:15.592\t505\t\"Compatibility fix applied to C:\\WINDOWS\\system32\\backgroundTaskHost.exe.\nFix information: Microsoft Apps, {81ecdb97-5112-41af-9a59-5ba9444f4270}, 0x80010101.\"\tInformation\tMicrosoft-Windows-Application-Experience/Program-Telemetry\tMicrosoft-Windows-Application-Experience\n05.09.2026 09:06:15.979\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:16.203\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:16.525\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:16.738\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:17.073\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:17.284\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:17.502\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:17.715\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:18.043\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:18.369\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:18.588\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:18.922\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:19.139\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:19.466\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:19.688\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:19.902\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:20.125\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:20.346\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:20.564\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:20.774\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:21.201\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:21.413\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:21.733\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:22.062\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:22.393\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:22.611\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:23.255\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:23.474\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:23.805\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:24.243\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:24.571\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:24.898\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:25.114\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:25.328\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:25.545\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:25.763\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:25.981\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:26.199\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:26.411\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:26.438\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:26.443\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:44.416\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:44.419\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:44.628\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:44.955\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:45.383\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:06:45.405\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:06:45.405\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:06:45.496\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:45.705\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:45.916\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:46.241\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:46.269\t10016\t\"The \u0434\u043b\u044f \u043a\u043e\u043d\u043a\u0440\u0435\u0442\u043d\u043e\u0433\u043e \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f permission settings do not grant \u041b\u043e\u043a\u0430\u043b\u044c\u043d\u043e \u0410\u043a\u0442\u0438\u0432\u0430\u0446\u0438\u044f permission for the COM Server application with CLSID \n{9EA82395-E31B-41CA-8DF7-EC1CEE7194DF}\n and APPID \n{2ED83BAA-B2FD-43B1-99BF-E6149C622692}\n to the user NT AUTHORITY\\NETWORK SERVICE SID (S-1-5-20) from address LocalHost (\u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c LRPC) running in the application container \u041d\u0435\u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e SID (\u041d\u0435\u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e). This security permission can be modified using the Component Services administrative tool.\"\tWarning\tSystem\tMicrosoft-Windows-DistributedCOM\n05.09.2026 09:06:46.462\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:46.673\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:46.751\t16\tCounter 11 of instance ({00000000-0000-0000-0000-000000000000}, NULL, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 09:06:46.751\t16\tCounter 6 of instance ({00000000-0000-0000-0000-000000000000}, NULL, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 09:06:47.198\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:47.525\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:47.738\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:48.068\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:48.180\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:06:48.180\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:06:48.288\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:48.621\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:48.817\t16\tCounter 11 of instance ({00000000-0000-0000-0000-000000000000}, NULL, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 09:06:48.817\t16\tCounter 6 of instance ({00000000-0000-0000-0000-000000000000}, NULL, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 09:06:48.943\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:49.155\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:49.478\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:49.803\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:50.025\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:50.242\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:50.684\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:50.898\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:51.113\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:51.337\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:51.659\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:51.973\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:51.977\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:51.983\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:54.177\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:06:54.177\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:06:54.194\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:06:54.194\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:06:59.590\t8001\t\"Skipping license manager: PFN Microsoft.ZuneMusic_11.2605.14.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:06:59.619\t8001\t\"Skipping license manager: PFN Microsoft.ZuneMusic_11.2605.14.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:06:59.624\t22\tSuspended: false\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 09:06:59.644\t22\tSuspended: true\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 09:06:59.644\t23\t\"Released exclusive mode resource false\nReleased offload mode resource true\"\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 09:06:59.662\t8001\t\"Skipping license manager: PFN Microsoft.ZuneMusic_11.2605.14.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:06:59.674\t8001\t\"Skipping license manager: PFN Microsoft.ZuneMusic_11.2605.14.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:06:59.679\t22\tSuspended: false\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 09:06:59.717\t22\tSuspended: true\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 09:06:59.717\t23\t\"Released exclusive mode resource false\nReleased offload mode resource true\"\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 09:07:02.970\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:07:02.971\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:07:02.971\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:07:02.989\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:07:08.724\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:08.732\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:08.947\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:09.170\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:09.726\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:10.287\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:10.622\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:10.848\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:11.070\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:11.519\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:11.696\t62443\tAppDefault Info: SetDefault: Association=.arw, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:11.697\t62443\tAppDefault Info: SetDefault-Info: Association=.arw, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h, U=S-1-5-21-3712849175-2219398513-4278588552-1006, T=2026:09:06:05:02:07, H=kCjQmAohRqY=\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:11.698\t62441\tUser choice has been reset to prog id AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h for .arw. CurrentDefaultProgId: . ShouldToast: false\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:11.742\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:11.765\t62443\tAppDefault Info: SetDefault: Association=.cr2, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:11.765\t62443\tAppDefault Info: SetDefault-Info: Association=.cr2, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h, U=S-1-5-21-3712849175-2219398513-4278588552-1006, T=2026:09:06:05:02:07, H=2LRzAJEadCU=\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:11.767\t62441\tUser choice has been reset to prog id AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h for .cr2. CurrentDefaultProgId: . ShouldToast: false\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:11.772\t62443\tAppDefault Info: SetDefault: Association=.crw, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:11.773\t62443\tAppDefault Info: SetDefault-Info: Association=.crw, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h, U=S-1-5-21-3712849175-2219398513-4278588552-1006, T=2026:09:06:05:02:07, H=HJQgB02ygrk=\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:11.774\t62441\tUser choice has been reset to prog id AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h for .crw. CurrentDefaultProgId: . ShouldToast: false\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:11.843\t62443\tAppDefault Info: SetDefault: Association=.erf, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:11.844\t62443\tAppDefault Info: SetDefault-Info: Association=.erf, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h, U=S-1-5-21-3712849175-2219398513-4278588552-1006, T=2026:09:06:05:02:07, H=WgihQKSXr1o=\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:11.845\t62441\tUser choice has been reset to prog id AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h for .erf. CurrentDefaultProgId: . ShouldToast: false\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:11.979\t62443\tAppDefault Info: SetDefault: Association=.kdc, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:11.979\t62443\tAppDefault Info: SetDefault-Info: Association=.kdc, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h, U=S-1-5-21-3712849175-2219398513-4278588552-1006, T=2026:09:06:05:02:07, H=5ydB7X/RwP0=\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:11.981\t62441\tUser choice has been reset to prog id AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h for .kdc. CurrentDefaultProgId: . ShouldToast: false\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.044\t62443\tAppDefault Info: SetDefault: Association=.mrw, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.044\t62443\tAppDefault Info: SetDefault-Info: Association=.mrw, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h, U=S-1-5-21-3712849175-2219398513-4278588552-1006, T=2026:09:06:05:02:07, H=rwQ71rimZz0=\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.045\t62441\tUser choice has been reset to prog id AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h for .mrw. CurrentDefaultProgId: . ShouldToast: false\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.067\t62443\tAppDefault Info: SetDefault: Association=.nef, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.068\t62443\tAppDefault Info: SetDefault-Info: Association=.nef, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h, U=S-1-5-21-3712849175-2219398513-4278588552-1006, T=2026:09:06:05:02:07, H=/OWLRdhzScI=\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.069\t62441\tUser choice has been reset to prog id AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h for .nef. CurrentDefaultProgId: . ShouldToast: false\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.074\t62443\tAppDefault Info: SetDefault: Association=.nrw, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.075\t62443\tAppDefault Info: SetDefault-Info: Association=.nrw, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h, U=S-1-5-21-3712849175-2219398513-4278588552-1006, T=2026:09:06:05:02:07, H=xf0wm/99VTY=\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.076\t62441\tUser choice has been reset to prog id AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h for .nrw. CurrentDefaultProgId: . ShouldToast: false\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.110\t62443\tAppDefault Info: SetDefault: Association=.orf, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.111\t62443\tAppDefault Info: SetDefault-Info: Association=.orf, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h, U=S-1-5-21-3712849175-2219398513-4278588552-1006, T=2026:09:06:05:02:07, H=s4wVpyO2sbI=\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.112\t62441\tUser choice has been reset to prog id AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h for .orf. CurrentDefaultProgId: . ShouldToast: false\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.139\t62443\tAppDefault Info: SetDefault: Association=.pef, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.140\t62443\tAppDefault Info: SetDefault-Info: Association=.pef, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h, U=S-1-5-21-3712849175-2219398513-4278588552-1006, T=2026:09:06:05:02:07, H=Fwt4454OVUg=\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.142\t62441\tUser choice has been reset to prog id AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h for .pef. CurrentDefaultProgId: . ShouldToast: false\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.144\t62443\tAppDefault Info: SetDefault: Association=.rw2, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.144\t62443\tAppDefault Info: SetDefault-Info: Association=.rw2, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h, U=S-1-5-21-3712849175-2219398513-4278588552-1006, T=2026:09:06:05:02:07, H=fT/lpga0FrA=\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.145\t62441\tUser choice has been reset to prog id AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h for .rw2. CurrentDefaultProgId: . ShouldToast: false\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.147\t62443\tAppDefault Info: SetDefault: Association=.rwl, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.148\t62443\tAppDefault Info: SetDefault-Info: Association=.rwl, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h, U=S-1-5-21-3712849175-2219398513-4278588552-1006, T=2026:09:06:05:02:07, H=eALmzLcL2KQ=\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.149\t62441\tUser choice has been reset to prog id AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h for .rwl. CurrentDefaultProgId: . ShouldToast: false\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.151\t62443\tAppDefault Info: SetDefault: Association=.sr2, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.151\t62443\tAppDefault Info: SetDefault-Info: Association=.sr2, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h, U=S-1-5-21-3712849175-2219398513-4278588552-1006, T=2026:09:06:05:02:07, H=JalBijRtIoY=\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.152\t62441\tUser choice has been reset to prog id AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h for .sr2. CurrentDefaultProgId: . ShouldToast: false\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.179\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:12.182\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"SystemSettings\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:12.204\t62443\tAppDefault Info: SetDefault: Association=.raf, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.205\t62443\tAppDefault Info: SetDefault-Info: Association=.raf, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h, U=S-1-5-21-3712849175-2219398513-4278588552-1006, T=2026:09:06:05:02:07, H=oEXJu51jr5A=\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.206\t62441\tUser choice has been reset to prog id AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h for .raf. CurrentDefaultProgId: . ShouldToast: false\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:15.798\t8001\t\"Skipping license manager: PFN Microsoft.WindowsFeedbackHub_2.2606.702.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:23.901\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-545\n\tGroup Name:\t\t\u041f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0438\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x4898\n\tProcess Name:\t\tC:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\Install\\{7AE247B5-7D18-48A0-9B9D-4C720227B85A}\\EDGEMITMP_6B0BB.tmp\\setup.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:26.950\t2099\t\"A rule has been modified in the Windows Defender Firewall exception list.\n\nModified Rule:\n\tRule ID:\t{3A17513B-146E-4698-9896-089E544D6F2D}\n\tRule Name:\tb728b6eb-c102-432c-bafa-2c6c87562485\n\tOrigin:\tLocal\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPrivate,Domain, Public\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\n\tService Name:\t\n\tProtocol:\tUDP\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\Install\\{7AE247B5-7D18-48A0-9B9D-4C720227B85A}\\EDGEMITMP_6B0BB.tmp\\setup.exe\n\tPolicyAppId:\t\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 09:07:26.978\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\t{3A17513B-146E-4698-9896-089E544D6F2D}\n\tRule Name:\tb728b6eb-c102-432c-bafa-2c6c87562485\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\Install\\{7AE247B5-7D18-48A0-9B9D-4C720227B85A}\\EDGEMITMP_6B0BB.tmp\\setup.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 09:07:26.985\t2099\t\"A rule has been modified in the Windows Defender Firewall exception list.\n\nModified Rule:\n\tRule ID:\t{59B3BC6C-DAC9-49D8-927C-2E9ACB17425E}\n\tRule Name:\tMicrosoft Edge (mDNS-\u0432\u0445\u043e\u0434\u044f\u0449\u0438\u0439)\n\tOrigin:\t0\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPrivate,Domain, Public\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\n\tService Name:\t\n\tProtocol:\tUDP\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\Install\\{7AE247B5-7D18-48A0-9B9D-4C720227B85A}\\EDGEMITMP_6B0BB.tmp\\setup.exe\n\tPolicyAppId:\t\n\tError Code:\t2\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 09:07:26.988\t2097\t\"A rule has been added to the Windows Defender Firewall exception list.\n\nAdded Rule:\n\tRule ID:\t{59B3BC6C-DAC9-49D8-927C-2E9ACB17425E}\n\tRule Name:\tMicrosoft Edge (mDNS-\u0432\u0445\u043e\u0434\u044f\u0449\u0438\u0439)\n\tOrigin:\tLocal\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPrivate,Domain, Public\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\n\tService Name:\t\n\tProtocol:\tUDP\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\Install\\{7AE247B5-7D18-48A0-9B9D-4C720227B85A}\\EDGEMITMP_6B0BB.tmp\\setup.exe\n\tPolicyAppId:\t\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 09:07:27.400\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:27.409\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:27.838\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:28.282\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:28.884\t2000\t\"Process Name: C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\Install\\{7AE247B5-7D18-48A0-9B9D-4C720227B85A}\\EDGEMITMP_6B0BB.tmp\\setup.exe\nModule Name: C:\\Windows\\System32\\InstallService.dll\nBuild: 26100.1.amd64fre.ge_release.240331-1435, UBR: 9168\n\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:28.884\t2006\t\"Setting MSA Client Id for Token requests: {f0c62012-2cef-4831-b1f7-930682874c86}\nError: Unspecified error\nFunction: \nSource: onecoreuap\\enduser\\winstore\\auth\\lib\\winstoreauth.cpp (206)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:28.927\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:28.927\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:28.945\t603\tStarted deployment Stage operation on a package with main parameter EdgeGameAssist.msix and Options NormalPriorityRequest and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:07:28.945\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:28.947\t100\tClipSVC service is starting.  Caller: \tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 09:07:28.962\t101\tClipSVC service is running.  Version 10.0.26100.9168\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 09:07:28.968\t2005\t\"oneSettingsconcurrentDefaultInstalls = 3, oneSettingsconcurrentMinInstalls = 3\nError: Unknown HResult Error code: 0xefffffff\nFunction: GetConcurrentInstallsFromOneSettings\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (763)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:28.980\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 9308) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffbf0767243, module offset: 0x17243, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x1a3c5fd1200, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 09:07:28.981\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 9308) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffbf075fda9, module offset: 0xfda9, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x1a3c5fdae80, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 09:07:28.981\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 9308) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffbf07690c3, module offset: 0x190c3, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x1a3c5fdae89, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 09:07:28.981\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 9308) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffbf07606ff, module offset: 0x106ff, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x1a3c5fdaea8, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 09:07:28.981\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 9308) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffbf07589fd, module offset: 0x89fd, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x1a3c5fdaea0, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 09:07:28.982\t157\tThe app package signature was validated for core content of the app package published by CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US. Payload won't be validated until the files are read.\tInformation\tMicrosoft-Windows-AppxPackaging/Operational\tMicrosoft-Windows-AppxPackagingOM\n05.09.2026 09:07:28.985\t2006\t\"Checking interactive for install caller: setup-StartProductInstallWithOptionsAsync\nError: Unknown HResult Error code: 0xefffffff\nFunction: Utils::IsCallerInteractive\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\utils.cpp (371)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.017\t216\tApp manifest validation warning: Declared namespace http://schemas.microsoft.com/developer/appx/2015/build is inapplicable, it will be ignored during manifest processing.\tWarning\tMicrosoft-Windows-AppxPackaging/Operational\tMicrosoft-Windows-AppxPackagingOM\n05.09.2026 09:07:29.020\t170\tThe streaming reader was created successfully for app package Microsoft.Edge.GameAssist_1.0.4019.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppxPackaging/Operational\tMicrosoft-Windows-AppxPackagingOM\n05.09.2026 09:07:29.024\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_3.rslc for Stage Operation on Package Microsoft.Edge.GameAssist_1.0.4019.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:07:29.025\t607\tDeployment Stage operation on package Microsoft.Edge.GameAssist_1.0.4019.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1006.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:07:29.025\t854\tSuccessfully added the following uri(s) to be processed:  file:///C:/Program%20Files%20(x86)/Microsoft/Edge/Application/152.0.4191.66/edge_game_assist/EdgeGameAssist.msix.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:07:29.057\t221\tANALYZE command has run; database statistics are updated [Partition=1, ProcessId=3720, Scope=(database)]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:07:29.063\t2005\t\"OneSettingsOnlineScanInterval (in seconds) = 86400\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1220)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.063\t2005\t\"OneSettingsOnlineScansAllowedInInterval = 10\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1222)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.063\t2005\t\"OneSettingsOnlineScanCooldown (in seconds) = 30\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1243)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.063\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (537)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.063\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (537)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.063\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (556)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.063\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (556)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.063\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (537)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.063\t2005\t\"DirectDownloadEnablementState fetched from cache: 2\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadDirectDownloadEnablementState\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2867)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.063\t2005\t\"DirectDownloadEnablementSettings fetched from OneSettings payload: [{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[\"\"Install\"\"],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[\"\"Microsoft.WindowsStore_8wekyb3d8bbwe\"\"],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[\"\"9NKSQGP7F2NH\"\",\"\"9NRX63209R7B\"\",\"\"9NTXR16HNW1T\"\",\"\"9PLM9XGG6VKS\"\"],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[\"\"0x00000000\"\",\"\"0x80004004\"\",\"\"0x80070032\"\",\"\"0x8007029C\"\",\"\"0x8007045B\"\",\"\"0x80070520\"\",\"\"0x80073CFB\"\",\"\"0x80073CFF\"\",\"\"0x80073D0A\"\",\"\"0x80073D13\"\",\"\"0x80073D19\"\",\"\"0x80073D22\"\",\"\"0x80240008\"\",\"\"0x8024001E\"\",\"\"0x80240066\"\",\"\"0x803FB003\"\",\"\"0x803FB015\"\",\"\"0xC8000710\"\",\"\"0x80073CF4\"\",\"\"0x80073D01\"\",\"\"0x80070070\"\",\"\"0x80073D21\"\",\"\"0x80246017\"\",\"\"0x80073CFE\"\"],\"\"regions\"\":[],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[\"\"9PLRGHGXR4FM\"\"],\"\"arches\"\":[],\"\"installTypes\"\":[\"\"Install\"\"],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Allowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[\"\"CN\"\"],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[\"\"9N3RK8ZV2ZR8\"\",\"\"9NRZT3Q9R3DL\"\",\"\"9P2B8MCSVPLN\"\",\"\"9NPV76S164X5\"\",\"\"9NBLGGH4RV3P\"\",\"\"9NBLGGH4SVJT\"\",\"\"9PHBC65ZG12V\"\",\"\"9NKSQGP7F2NH\"\",\"\"9NKRJ3SJ9SDG\"\"],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[\"\"DellInc.AlienwareCommandCenter_htrsf667h5kn2\"\",\"\"DSIC\"\",\"\"explorer\"\",\"\"AICompanion\"\",\"\"HP.Omen.OmenCommandCenter\"\",\"\"setup\"\",\"\"Language Overlay Service\"\",\"\"TabTip\"\",\"\"LiveCaptions\"\",\"\"Undetermined\"\",\"\"GamingService\"\"],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[\"\"Install\"\"],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Allowed\"\"}]\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadDirectDownloadEnablementSettings\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2891)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2944)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2007\t\"Error while reading DirectDownloadReplacementSettings from OneSettings cache, value will remain empty\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1360)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2005\t\"DirectDownloadEnablementLiveCheckThreshold in milliseconds fetched from cache: 600000\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadDirectDownloadEnablementLiveCheckThreshold\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (3005)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2005\t\"ProductCatalogUrl fetched from cache: https://fe3cr.delivery.mp.microsoft.com/ClientWebService/client.asmx/secured\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadProductCatalogUrl\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (3027)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2005\t\"SfEdgeFallbackEndpointUrl fetched from cache: https://sfdataservice.microsoft.com/package-retrieval\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadSfEdgeFallbackEndpointUrl\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (3048)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2005\t\"CheckpointAbandonmentRules fetched from OneSettings payload: [{\"\"callerApplicationIdKeyword\"\":\"\"WindowsStore\"\",\"\"systemAttemptCountThreshold\"\":5,\"\"creationTimestampThresholdInDays\"\":2},{\"\"callerApplicationIdKeyword\"\":\"\"MoUsoCoreWorker\"\",\"\"systemAttemptCountThreshold\"\":2,\"\"creationTimestampThresholdInDays\"\":2}]\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadCheckpointAbandonmentRules\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (3235)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (556)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (575)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2006\t\"Update block list not found or empty in OneSettings\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1457)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2006\t\"setup-StartProductInstallWithOptionsAsync is in the disallow list, setting userInteractive = false\nError: Unknown HResult Error code: 0xefffffff\nFunction: Utils::IsCallerInteractive\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\utils.cpp (374)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2006\t\"request: productId = 9NRZT3Q9R3DL, skuId = , catalogId = , flightId = , volumePath = , CV = Jiuk4NoDe0amEI4m.0, repair = false, userInteractive = false, allowDownloadOnAnyNetwork = false, forceUseOfNonRemovableStorage = false, allowForcedAppRestart = false, launchAfterInstall = false\nError: Unknown HResult Error code: 0xefffffff\nFunction: Windows::ApplicationModel::Store::Preview::InstallControl::AppInstallManagerImpl::_StartBundleProductInstallAsync\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\appinstallcontrol.cpp (5357)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2006\t\"[Telemetry]: InstallOperationRequest :: __TlgCV__ = Jiuk4NoDe0amEI4m.0 \u00a0ProductId = 9NRZT3Q9R3DL \u00a0SkuId =  \u00a0CatalogId =  \u00a0BundleId =  \u00a0VolumePath =  \u00a0\nError: Unknown HResult Error code: 0xefffffff\nFunction: LogTelemetryEvent\nSource: onecoreuap\\enduser\\winstore\\installservice\\svc\\logging.cpp (10)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.065\t2006\t\"Creating InstallServiceWork StoreId = 9NRZT3Q9R3DL \u00a0\u00a0\nError: The operation completed successfully.\nFunction: winrt::Windows::Internal::InstallService::Control::implementation::InstallServiceControl::CreateInstallServiceWork\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\windows.internal.installservice.control.installservicecontrol.cpp (57)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.066\t2006\t\"Creating work for InstallQueue2 CatalogId = StoreId:9NRZT3Q9R3DL \u00a0\u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::CreateWork\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (1524)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.066\t2006\t\"Queueing Work for Catalog Item\nError: The operation completed successfully.\nFunction: InstallQueue2::CreateWork\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (1549)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.067\t2006\t\"[Start] Plugin available, Creating Work for Catalog Item\u00a0UserSID = S-1-5-18 \u00a0CatalogId = StoreId:9NRZT3Q9R3DL \u00a0properties = {\"\"UserIdentityInfo\"\":\"\"\"\",\"\"VolumePath\"\":\"\"\"\",\"\"CallerApplicationId\"\":\"\"setup-StartProductInstallWithOptionsAsync\"\",\"\"IsInteractive\"\":false,\"\"AllowDownloadOnAnyNetwork\"\":false,\"\"Repair\"\":false,\"\"AllowForcedAppRestart\"\":false,\"\"ForceUseOfNonRemovableStorage\"\":false,\"\"InstallForAllUsers\"\":true,\"\"StageButDoNotInstall\"\":false,\"\"CatalogId\"\":\"\"\"\",\"\"RequiresElevation\"\":false,\"\"LaunchAfterInstall\"\":false,\"\"ParentBundleId\"\":\"\"\"\"} \u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::CreateWorkForCatalogItem\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (1731)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.069\t2006\t\"[End] Plugin available, Creating Work for Catalog Item\u00a0UserSID = S-1-5-18 \u00a0CatalogId = StoreId:9NRZT3Q9R3DL \u00a0properties = {\"\"UserIdentityInfo\"\":\"\"\"\",\"\"VolumePath\"\":\"\"\"\",\"\"CallerApplicationId\"\":\"\"setup-StartProductInstallWithOptionsAsync\"\",\"\"IsInteractive\"\":false,\"\"AllowDownloadOnAnyNetwork\"\":false,\"\"Repair\"\":false,\"\"AllowForcedAppRestart\"\":false,\"\"ForceUseOfNonRemovableStorage\"\":false,\"\"InstallForAllUsers\"\":true,\"\"StageButDoNotInstall\"\":false,\"\"CatalogId\"\":\"\"\"\",\"\"RequiresElevation\"\":false,\"\"LaunchAfterInstall\"\":false,\"\"ParentBundleId\"\":\"\"\"\"} \u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::CreateWorkForCatalogItem\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (1731)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.069\t2006\t\"Work already enqueued. Refusing to queue duplicate workCatalogId = PackageFamilyName:Microsoft.WindowsAppRuntime.2_8wekyb3d8bbwe \u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::_EnqueueWork\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (2184)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.069\t2006\t\"[Start] Item inserted into the queue. Attempting to create progresstrackersItem = 9NRZT3Q9R3DL \u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::_EnqueueWork\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (2335)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.069\t2006\t\"[End] Item inserted into the queue. Attempting to create progresstrackersItem = 9NRZT3Q9R3DL \u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::_EnqueueWork\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (2335)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.073\t2006\t\"Received checkpoint data updateItem = 9NRZT3Q9R3DL \u00a0\u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::NotifyCheckpointChanged\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (3602)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.073\t2006\t\"Raising State Change for Item = , InstallState = 12 \u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::FlushEventQueue\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (3547)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.073\t2006\t\"[Telemetry]: FulfillmentInitiate :: ProductId = 9NRZT3Q9R3DL \u00a0PFN = Microsoft.WindowsAppRuntime.2_8wekyb3d8bbwe \u00a0InstalledPFuN = (null) \u00a0CatalogId =  \u00a0FulfillmentPluginId = WU \u00a0PluginTelemetryData =  \u00a0PluginWorkCreationHr = 0 \u00a0ClientAppId = Acquisition;setup-StartProductInstallWithOptionsAsync \u00a0QueueItemsTotal = 1 \u00a0QueueItemsWorking = 0 \u00a0QueueItemsPending = 0 \u00a0QueueItemsIdle = 1 \u00a0QueueOpenSlots = 3 \u00a0__TlgCV__ = Jiuk4NoDe0amEI4m.0.2 \u00a0\nError: Unknown HResult Error code: 0xefffffff\nFunction: LogTelemetryEvent\nSource: onecoreuap\\enduser\\winstore\\installservice\\svc\\logging.cpp (10)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.074\t2006\t\"Queue State: Working = 0, Pending = 0, Idle = 1 \u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::_FindNextPendingItem\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (4794)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.075\t2006\t\"Queue State: Working = 0, Pending = 0, Idle = 1 \u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::_FindNextPendingItem\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (4794)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.076\t221\tANALYZE command has run; database statistics are updated [Partition=2, ProcessId=3720, Scope=(database)]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:07:29.077\t2152\tInstall progress state changed for package:Microsoft.WindowsAppRuntime.2_8wekyb3d8bbwe to state:12.\tInformation\tMicrosoft-Windows-ShellCommon-StartLayoutPopulation/Operational\tMicrosoft-Windows-ShellCommon-StartLayoutPopulation\n05.09.2026 09:07:29.083\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:07:29.087\t617\tSuccessfully updated the status for package Microsoft.Edge.GameAssist_1.0.4019.0_x64__8wekyb3d8bbwe and user S-1-5-18 (Clear=0x10000C00, Set=0x0).\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:07:29.087\t400\tDeployment Stage operation with target volume C: on Package Microsoft.Edge.GameAssist_1.0.4019.0_x64__8wekyb3d8bbwe from:  (EdgeGameAssist.msix)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:07:29.104\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:07:29.111\t16394\tOffline downlevel migration succeeded.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 09:07:29.114\t613\t\"Performance summary of Deployment Stage operation on Package Microsoft.Edge.GameAssist_1.0.4019.0_x64__8wekyb3d8bbwe: \nOverall time: 171 ms (Active time: 171 ms)\nEnqueue cost: 78 ms\nDequeue delay: 0 ms\nBundle processing cost: 0 ms\nIndexing cost: 0 ms\nResolve dependency cost: 0 ms\nCheck approval cost: 15 ms\nEvaluation cost: 0 ms\nHardlinking evaluation cost: 0 ms\nStage required cost: 0 ms\nFlushing and closing files cost: 0 ms\nMachine register cost: 0 ms\nStage user data cost: 0 ms\nRegistration cost: 0 ms\nRepository commit transaction cost: 47 ms\nData flush cost: 0 ms\nPost DeStage repository commit transaction cost: 31 ms\nRemaining cost: 0 ms\n\"\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:07:29.115\t603\tStarted deployment ProvisionPackageOperation operation on a package with main parameter Microsoft.Edge.GameAssist_8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:07:29.117\t404\tAppX Deployment operation failed for package Microsoft.Edge.GameAssist_8wekyb3d8bbwe with error 0x80070005. The specific error text for this failure is: NULL\tError\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:07:29.616\t157\tThe license with Id 2da6ca43-2e6f-1f16-05ad-a9959043ddb7 has been archived successfully.  PFM if available: Microsoft.Windows.99.X20-15863_8wekyb3d8bbwe\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 09:07:29.616\t116\t\"Application license successfully installed.\nPackage: Microsoft.Windows.99.X20-15863_8wekyb3d8bbwe\nUser Id (if available): NULL\nLicense Id: 2da6ca43-2e6f-1f16-05ad-a9959043ddb7\nAssociate Id: 2da6ca43-2e6f-1f16-05ad-a9959043ddb7\"\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 09:07:29.623\t8001\t\"Licensing content 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: OneStoreApplicationLicenseManager::ActivateLicenseForContent\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\onestoreapplicensemanager.cpp (410)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.623\t8001\t\"Licensing 807d73a3-33f2-c21b-c47a-85c313d97af9 (Active)\nFunction: LicenseManager::LicenseContentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\manager.cpp (88)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.623\t8002\t\"Capturing identity for LocalSystem, this probably isn't intended\nFunction: StoredIdentity::StoredIdentity\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\identity.cpp (536)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.624\t8001\t\"0000021F831D31E0: Key Machine for content: 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: KeyMachine::KeyMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (95)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.624\t8011\t0x21f83133e68: 16532: RootMachine: Dispatch: Root:Connect => Root:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.624\t8011\t0x21f831d3200: 16532: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:Activate => Key:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.624\t8001\t\"0000021F831D31E0: BeginLicense: Operation 3, CachedLeaseOK true, RequireServiceValidation false\nFunction: KeyMachine::DoBeginLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (819)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.624\t8012\t0x21f831d3200: 16532: Key:Initial Change: Key:NegotiatingUnleased => 807d73a3-33f2-c21b-c47a-85c313d97af9\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.625\t8001\t\"Considering License ID {2DA6CA43-2E6F-1F16-05AD-A9959043DDB7} for content ID 807d73a3-33f2-c21b-c47a-85c313d97af9...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.625\t8001\t\"Accepting key with License ID {2DA6CA43-2E6F-1F16-05AD-A9959043DDB7} for Content ID 807d73a3-33f2-c21b-c47a-85c313d97af9 (first match)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (223)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.625\t8001\t\"Considering License ID {8CB56148-398C-A7C4-98F2-6FDC89C2093D} for content ID 807d73a3-33f2-c21b-c47a-85c313d97af9...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.625\t8001\t\"Ignoring key for 807d73a3-33f2-c21b-c47a-85c313d97af9 with quality fffffff (0xc0ea0009) (no better than best)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (251)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.625\t8001\t\"Considering License ID {BDBB3CA5-594E-7337-A093-A9860F553465} for content ID 807d73a3-33f2-c21b-c47a-85c313d97af9...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.625\t8001\t\"Decoding: {}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.625\t8001\t\"Accepting key with License ID {BDBB3CA5-594E-7337-A093-A9860F553465} for Content ID 807d73a3-33f2-c21b-c47a-85c313d97af9 (better quality: 7f000000 vs 1fffffff)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (229)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.626\t8001\t\"Returning key document for contentid 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (262)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.626\t8001\t\"Getting lease for 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: LicenseManagerCore::GetExistingLeaseAndLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (415)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.628\t8001\t\"Ignoring otherwise matching lease ({33B013F2-4858-241D-9000-CA9374B3ADB5}) for Content ID 807D73A3-33F2-C21B-C47A-85C313D97AF9 because of quality 268435455 (0xc0ea000a)\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (396)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.628\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.628\t8001\t\"Adding lease {AE9143F3-8179-89B2-A3AF-FFC1D366D1AE} to results\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (387)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.628\t8001\t\"Returning 1 lease documents for contentid 807D73A3-33F2-C21B-C47A-85C313D97AF9\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.629\t8001\t\"lease = 0x831ad058, usage = 536870912, policy = 2147483647, operation = 3, leaseBehavior = 0, shouldContentBeDeactivated = 0\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (905)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.629\t8001\t\"lease = 0x831ad058, quality = 1073741824\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (935)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.629\t8001\t\"content is alreadyLicensed, lease is cached\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (942)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.629\t8011\t0x21f831d3200: 16532: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:@LicenseDone => Key:NegotiatingUnleased\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.633\t8002\t\"Failure Message: hr: 0x80070490\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\misc.cpp (49)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.633\t8001\t\"lease = 0x831ad058, leaseActive = 1, leaseBehavior = 0\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1986)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.633\t8001\t\"Lease Machine: 0000021F8312B600: {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: LeaseMachine::LeaseMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (40)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.633\t8001\t\"Set results for lease = 0x831ad058, policy = 2147483647, operation = 3, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.633\t8001\t\"No cached lease or key found, not renewing with service and treating this as a valid license with lease = 0x831ad058\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (2032)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.633\t8012\t0x21f831d3200: 16532: Key:NegotiatingUnleased Change: Key:Valid => 807d73a3-33f2-c21b-c47a-85c313d97af9\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.633\t8011\t0x21f8312b620: 16532: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:UpdateLeaseDocument => Lease:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.633\t8012\t0x21f8312b620: 16532: Lease:Initial Change: Lease:Valid => {2CE050AC-4159-AABB-AC60-9CED070AF672}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.633\t8001\t\"Decoding: {}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.633\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.633\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.634\t8011\t0x21f831d3200: 4424: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:RegisterCallback => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.634\t8011\t0x21f831d3200: 10704: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:Unregistered => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.634\t8001\t\"Lease dropped\nFunction: KeyMachine::DoDropLease\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (279)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.634\t8012\t0x21f831d3200: 10704: Key:Valid Change: Key:Invalid => 807d73a3-33f2-c21b-c47a-85c313d97af9\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.634\t8001\t\"Updating lease timer for {2CE050AC-4159-AABB-AC60-9CED070AF672} to expire @ 2026-09-11T13:58:38Z (jitter was 43.043484 minutes)\nFunction: LeaseMachine::DoUpdateLeaseTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (276)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.634\t8001\t\"Set results for lease = 0x0, policy = 0, operation = 0, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.634\t8001\t\"Added timer for {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: MemoryTimerService::CreateTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (57)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.634\t8011\t0x21f8312b620: 16532: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:AddKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.634\t8011\t0x21f8312b620: 16532: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:RemoveKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.634\t8011\t0x21f8312b620: 16532: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:Unregistered => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.634\t8012\t0x21f8312b620: 16532: Lease:Valid Change: Lease:Invalid => {2CE050AC-4159-AABB-AC60-9CED070AF672}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.634\t8001\t\"Requesting lease document removal for reason 0x00000000, {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: LicenseManagerCore::DoRemoveLeaseDocumentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (1460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.634\t173\tProduct key from MSDM table redeemed. Result: 0x0\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 09:07:29.635\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.635\t8001\t\"Ignoring lease removal with reason 0x00000000 because this is an offline lease\n\nFunction: ClipStorage::RemoveLeaseDocumentWithIdAndReason\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (501)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.636\t8002\t\"Trying to remove timer {2CE050AC-4159-AABB-AC60-9CED070AF672} not in table\nFunction: MemoryTimerService::CancelTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (80)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.636\t8001\t\"Removed timer for {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: MemoryTimerService::CleanupTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (19)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.678\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:29.678\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:29.836\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:30.043\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:30.043\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:30.057\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:30.075\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:30.075\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:30.075\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:30.076\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:30.076\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:30.077\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:30.106\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:30.106\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:30.106\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:30.328\t28017\tAppResolver Scan Started.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:30.339\t28032\tAppResolver has parsed the visual elements manifest for a tile.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:30.340\t28117\tShortcut for application Microsoft Edge with ID MSEdge and flags 0x39 is updated in app resolver cache.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:30.364\t28032\tAppResolver has parsed the visual elements manifest for a tile.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:30.365\t28117\tShortcut for application Microsoft Edge with ID MSEdge and flags 0x19 is updated in app resolver cache.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:30.368\t28018\tAppResolver Scan Stopped.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:30.371\t28019\tAppResolver Cache Committed.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:30.378\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:07:30.392\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:30.614\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:30.850\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:30.851\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:30.855\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:30.855\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:31.059\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:31.281\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:31.505\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:31.727\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:32.508\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:32.683\t1\t\tInformation\tMicrosoft-Windows-WER-PayloadHealth/Operational\tMicrosoft-Windows-WER-PayloadHealth\n05.09.2026 09:07:32.729\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:32.838\t1001\t\"Fault bucket 1335943769315561378, type 5\nEvent Name: crashpad_log\nResponse: \u041d\u0435\u0442 \u0434\u0430\u043d\u043d\u044b\u0445\nCab Id: 0\n\nProblem signature:\nP1: setup.exe\nP2: 152.0.4191.66\nP3: EdgeInstallerError|msedge\nP4: 0x21f\nP5: \nP6: \nP7: \nP8: \nP9: \nP10: \n\nAttached files:\n\\\\?\\C:\\Windows\\SystemTemp\\msedge_installer.log\n\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp\\WER.cb0fd2f7-8c3a-4ec5-b556-d8539b63e7bb.tmp.WERInternalMetadata.xml\n\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp\\WER.1cd59d7b-10f5-456c-92c9-bbc2690c40cb.tmp.csv\n\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp\\WER.a91dcba5-995c-4c53-8ee9-ac97f2cc9341.tmp.txt\n\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp\\WER.2e064481-6563-48cd-bfde-c1fec5b5e223.tmp.xml\n\nThese files may be available here:\n\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\WER\\ReportArchive\\NonCritical_setup.exe_5e669a226662be207f9befb6263066e17763cb_00000000_511c3ca4-3902-47a0-b678-1fb4198c6818\n\nAnalysis symbol: \nRechecking for solution: 0\nReport Id: 511c3ca4-3902-47a0-b678-1fb4198c6818\nReport Status: 268435456\nHashed bucket: 66b5a28723fa9a68828a39c7b1f34fa2\nCab Guid: 0\"\tInformation\tApplication\tWindows Error Reporting\n05.09.2026 09:07:32.862\t1001\t\"Fault bucket , type 0\nEvent Name: crashpad_log\nResponse: \u041d\u0435\u0442 \u0434\u0430\u043d\u043d\u044b\u0445\nCab Id: 0\n\nProblem signature:\nP1: setup.exe\nP2: 152.0.4191.66\nP3: EdgeInstallerError|msedge\nP4: 0x21f\nP5: \nP6: \nP7: \nP8: \nP9: \nP10: \n\nAttached files:\n\\\\?\\C:\\Windows\\SystemTemp\\msedge_installer.log\n\nThese files may be available here:\nNULL\n\nAnalysis symbol: \nRechecking for solution: 0\nReport Id: 511c3ca4-3902-47a0-b678-1fb4198c6818\nReport Status: 268697600\nHashed bucket: \nCab Guid: 0\"\tInformation\tApplication\tWindows Error Reporting\n05.09.2026 09:07:32.950\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:33.285\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:33.506\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:33.726\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:33.947\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:34.170\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:34.380\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:34.604\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:34.827\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:35.047\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:35.269\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:35.593\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:35.814\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:36.258\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:36.481\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:36.706\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:36.933\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:37.145\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:37.585\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:38.034\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:38.255\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:38.474\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:38.694\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:38.909\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:39.243\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:39.464\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:39.687\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:39.901\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:41.333\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:41.775\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:41.999\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:42.561\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:42.895\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:43.783\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:43.837\t8001\t\"Skipping license manager: PFN Microsoft.ZuneMusic_11.2605.14.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:43.864\t8001\t\"Skipping license manager: PFN Microsoft.ZuneMusic_11.2605.14.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:43.889\t22\tSuspended: false\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 09:07:43.921\t22\tSuspended: true\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 09:07:43.921\t23\t\"Released exclusive mode resource false\nReleased offload mode resource true\"\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 09:07:44.007\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:44.229\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:44.449\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:44.895\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:45.119\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:45.919\t1\tTenant P-ARIA-af397ef28e484961ba48646a5d38cf54-77418283-d6f6-4a90-b0c8-37e0f5e7b087-7425 has been registered for telemetry usage.\tInformation\tMicrosoft-Windows-UniversalTelemetryClient/Operational\tMicrosoft-Windows-UniversalTelemetryClient\n05.09.2026 09:07:46.117\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:46.406\t0\tService stopped.\tInformation\tApplication\tedgeupdate\n05.09.2026 09:07:46.559\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:46.783\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:47.006\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:47.230\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:47.678\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:47.899\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:48.107\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, CIMWin32, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 09:07:48.121\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:48.681\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:49.017\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:49.241\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:49.798\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:50.020\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:50.241\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:50.461\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:50.682\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:52.022\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:54.809\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:55.033\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:55.258\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:55.265\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"OpenWith\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:59.356\t16384\tSuccessfully scheduled Software Protection service for re-start at 2126-08-12T02:07:59Z. Reason: RulesEngine.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 09:08:01.392\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:01.403\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:01.408\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:01.632\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:01.966\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:02.176\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:02.512\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:02.833\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:03.507\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:03.830\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:04.040\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:04.113\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:04.121\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:34.447\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:34.450\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:34.777\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:35.220\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:35.993\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:36.217\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:36.441\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:37.558\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:37.781\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:38.772\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:38.777\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"WINWORD\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:40.683\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:40.685\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:41.012\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:41.452\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:41.456\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"WINWORD\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:43.348\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:43.351\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:43.899\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:43.908\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:43.912\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"WINWORD\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:48.125\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, NetAdapterCim, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 09:08:54.158\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:54.161\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:54.387\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:54.609\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:54.830\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:55.275\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:56.276\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:56.713\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:56.931\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:57.268\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:57.490\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:58.049\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:58.270\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:58.492\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:58.716\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:59.052\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:59.498\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:59.721\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:59.945\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:00.278\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:00.500\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:00.725\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:00.947\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:01.391\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:01.616\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:01.839\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:02.060\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:02.283\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:02.507\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:02.731\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:03.513\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:03.848\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:04.072\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:04.406\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:04.961\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:05.294\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:05.517\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:05.739\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:06.184\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:06.407\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:06.629\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:07.187\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:07.409\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:07.633\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:07.854\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:08.299\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:08.857\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:09.636\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:09.969\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:10.193\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:10.420\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:10.642\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:10.864\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:11.087\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:11.423\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:11.647\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:11.868\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:12.533\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:12.755\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:13.089\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:13.645\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:14.201\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:14.425\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:14.649\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:15.207\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:15.431\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:15.654\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:15.877\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:16.323\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:16.547\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:16.769\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:16.990\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:17.993\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:18.329\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:18.554\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:19.447\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:19.782\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:20.335\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:21.225\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:21.557\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:22.337\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:22.671\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:22.894\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:23.339\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:23.776\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:24.884\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:25.427\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:25.759\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:25.984\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:26.649\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:27.097\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:27.321\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:27.543\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:28.101\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:28.438\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:28.883\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:29.223\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:29.446\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:30.564\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:34.465\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:35.360\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:36.144\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:37.578\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:38.137\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:38.361\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:38.585\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:39.925\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:40.704\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:41.371\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:41.587\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:42.033\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:44.483\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:45.154\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:45.485\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:45.707\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:45.931\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:46.266\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:46.491\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:46.825\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:47.047\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:47.271\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:47.495\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:47.831\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:48.169\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:48.391\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:48.617\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:49.173\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:49.397\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:49.619\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:49.840\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:50.050\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:50.713\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:50.926\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:51.248\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:51.466\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:52.132\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:52.577\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:53.020\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:53.242\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:53.689\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:53.915\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:54.582\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:54.913\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:55.135\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:55.359\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:56.916\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:57.139\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:57.806\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:58.474\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:58.696\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:59.028\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:59.250\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:59.585\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:00.032\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:00.256\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:00.478\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:00.700\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:00.922\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:01.593\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:02.377\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:02.600\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:02.932\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:03.155\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:03.713\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:03.934\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:04.267\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:04.937\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:05.161\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:05.384\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:05.715\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:06.159\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:06.383\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:07.047\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:07.369\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:07.809\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:08.032\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:08.255\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:08.476\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:08.699\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:08.923\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:09.923\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:10.144\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:10.367\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:10.590\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:11.482\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:12.041\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:12.264\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:12.709\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:13.044\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:15.051\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:15.495\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:15.717\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:16.161\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:16.718\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:16.941\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:17.163\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:17.493\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:17.937\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:18.384\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:18.608\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:19.162\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:19.385\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:19.608\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:20.387\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:20.609\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:20.832\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:21.054\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:21.390\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:22.394\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:22.841\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:23.289\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:23.513\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:23.737\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:23.959\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:24.182\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:24.516\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:24.741\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:24.964\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:25.965\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:26.300\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:26.523\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:26.857\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:27.081\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:27.304\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:27.526\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:28.190\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:28.857\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:29.079\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:29.302\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:30.749\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:31.083\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:31.419\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:31.643\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:33.204\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:33.537\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:34.205\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:34.428\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:34.985\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:35.545\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:35.881\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:36.105\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:38.114\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:38.671\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:38.895\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:39.119\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:39.452\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:39.676\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:39.899\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:40.675\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:40.898\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:42.011\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:42.345\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:42.568\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:42.791\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:43.013\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:44.127\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:44.461\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:44.795\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:45.017\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:45.577\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:45.801\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:46.134\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:46.359\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:46.582\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:46.805\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:48.034\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:48.481\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:48.704\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:49.486\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:50.032\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:50.251\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:50.809\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:51.033\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:51.593\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:51.930\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:52.376\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:52.598\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:53.218\t8001\t\"Skipping license manager: PFN Microsoft.ScreenSketch_11.2602.49.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:10:53.231\t8001\t\"Skipping license manager: PFN Microsoft.ScreenSketch_11.2602.49.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:10:53.231\t219\tPSMFlags for Desktop AppX process %1 with applicationID %2 is %3.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:10:53.269\t210\tCreated Desktop AppX container {245CDF31-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.ScreenSketch_11.2602.49.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:10:53.269\t211\tAdded process 14764 to Desktop AppX container 245cdf31-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.ScreenSketch_11.2602.49.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:10:53.271\t201\tCreated process 14764 for application Microsoft.ScreenSketch_8wekyb3d8bbwe!App in package Microsoft.ScreenSketch_11.2602.49.0_x64__8wekyb3d8bbwe. [LaunchProcess]\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:10:53.800\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:53.804\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"SnippingTool\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:57.468\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:57.472\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:57.689\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:58.354\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:58.689\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:59.246\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:59.250\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"SnippingTool\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:59.251\t2416\tA local notification was received from Microsoft.ScreenSketch_8wekyb3d8bbwe!App [AppUserModelId] with a 0 [NotificationId] through an application endpoint.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:10:59.256\t2418\tA local notification was submitted to threadpool: Microsoft.ScreenSketch_8wekyb3d8bbwe!App [AppUserModelId] toast [NotificationType] 9402 [NotificationTrackingId] Local [NotificationSource].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:10:59.264\t3052\tToast with notification tracking id 9402 is being delivered to Microsoft.ScreenSketch_8wekyb3d8bbwe!App on session 1.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:10:59.269\t3153\tToast with notification tracking id 9402 is delivered to Microsoft.ScreenSketch_8wekyb3d8bbwe!App on session 1.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:10:59.410\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:10:59.453\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:59.456\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:59.514\t217\tDestroyed Desktop AppX container {245CDF31-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.ScreenSketch_11.2602.49.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:10:59.515\t8001\t\"Skipping license manager: PFN Microsoft.ScreenSketch_11.2602.49.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:11:00.014\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:00.136\t24\t\"Stream started.\nApp Id: Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy!App\nPID: 13180\nAudio Stream Category: 5\"\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 09:11:00.572\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:01.014\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:01.348\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:01.470\t25\t\"Stream stopped.\nApp Id: Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy!App\nPID: 13180\nAudio Stream Category: 5\"\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 09:11:01.571\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:01.793\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:02.016\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:02.238\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:02.906\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:03.129\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:03.797\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:04.004\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:04.561\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:04.894\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:05.117\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:05.340\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:05.562\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:06.677\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:06.889\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:07.103\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:07.440\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:07.666\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:08.225\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:08.448\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:08.672\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:08.895\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:09.561\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:10.339\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:10.561\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:11.226\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:11.450\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:11.772\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:11.995\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:12.331\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:12.776\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:12.999\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:13.328\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:13.535\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:13.971\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:14.409\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:14.633\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:15.069\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:15.291\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:16.073\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:16.297\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:16.857\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:17.081\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:17.528\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:17.749\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:17.971\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:18.185\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:18.402\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:18.627\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:18.961\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:19.185\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:19.407\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:20.075\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:20.522\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:20.745\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:20.969\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:21.193\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:21.417\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:21.977\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:22.201\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:22.537\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:22.761\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:22.985\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:23.209\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:23.657\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:23.881\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:25.113\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:25.784\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:26.118\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:26.565\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:26.781\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:26.986\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:26.999\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:27.004\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:52.123\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:52.127\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:52.436\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:53.305\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:53.529\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:54.406\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:54.731\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:54.737\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:56.668\t16394\tOffline downlevel migration succeeded.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 09:12:08.354\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:08.358\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:08.805\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:09.473\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:09.916\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:10.139\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:10.362\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:10.809\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:11.142\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:12.362\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:13.698\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:14.146\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:14.477\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:15.033\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:15.593\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:15.817\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:16.041\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:16.489\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:17.049\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:17.273\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:17.945\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:18.169\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:18.392\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:18.615\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:19.176\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:19.619\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:20.288\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:20.613\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:21.505\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:21.726\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:22.173\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:22.399\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:23.068\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:23.401\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:24.182\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:25.521\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:26.965\t16384\tSuccessfully scheduled Software Protection service for re-start at 2126-08-12T02:12:26Z. Reason: RulesEngine.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 09:12:26.972\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:27.307\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:28.633\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:28.856\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:29.189\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:29.640\t102\tClipSVC service has shutdown.\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 09:12:29.748\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:30.082\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:31.413\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:32.084\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:32.309\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:32.533\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:32.758\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:33.317\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:33.651\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:35.097\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:36.329\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:36.553\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:36.777\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:38.009\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:38.666\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:38.881\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:39.310\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:39.524\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:39.749\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:40.070\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:40.282\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:40.287\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:42.172\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:42.175\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:42.389\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:43.388\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:43.834\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:44.389\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:44.713\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:45.049\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:45.273\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:45.721\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:46.057\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:46.393\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:46.617\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:46.841\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:47.286\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:47.510\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:47.733\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:48.405\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:48.852\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:49.407\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:49.740\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:49.962\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:50.185\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:50.853\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:51.411\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:51.965\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:52.188\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:52.521\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:52.857\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:53.305\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:53.529\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:53.974\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:54.197\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:54.757\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:54.981\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:55.429\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:55.765\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:55.989\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:56.325\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:56.771\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:56.995\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:57.217\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:57.442\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:57.776\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:58.110\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:58.554\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:58.765\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:58.988\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:59.322\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:01.002\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:01.226\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:01.449\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:01.897\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:02.677\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:02.901\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:03.125\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:03.570\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:03.793\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:04.126\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:04.571\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:04.795\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:05.008\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:05.335\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:05.668\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:05.889\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:06.111\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:06.333\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:07.445\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:07.666\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:07.889\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:08.224\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:08.665\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:08.887\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:09.110\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:09.553\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:10.102\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:10.548\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:10.885\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:11.221\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:11.555\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:11.781\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:12.000\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:12.221\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:12.444\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:13.449\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:13.778\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:14.229\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:14.234\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:17.306\t8001\t\"Skipping license manager: PFN Microsoft.ZuneMusic_11.2605.14.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:17.356\t8001\t\"Skipping license manager: PFN Microsoft.ZuneMusic_11.2605.14.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:17.361\t22\tSuspended: false\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 09:13:17.376\t22\tSuspended: true\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 09:13:17.376\t23\t\"Released exclusive mode resource false\nReleased offload mode resource true\"\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 09:13:29.447\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:29.450\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:39.819\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:54.106\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:54.997\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:55.663\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:56.218\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:56.553\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:57.110\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:57.442\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:57.602\t8001\t\"Invoking license manager because license/lease polling time up: PFN A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (361)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.603\t8001\t\"ServiceBeginAcquireLicenseImpl PsmKey:A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6+App, IsSystemUsage:1\nFunction: ServiceBeginAcquireLicenseImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2304)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.604\t8002\t\"Failure Message: hr: 0x800703f0\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2324)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.605\t8001\t\"Failure Message: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp(2324)\\LicenseManager.dll!00007FFBF486A702: (caller: 00007FFBF525134D) Exception(11) tid(20bc) 800703F0 \u041f\u043e\u043f\u044b\u0442\u043a\u0430 \u0441\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u043d\u0435\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0439 \u0442\u043e\u043a\u0435\u043d.\n\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2348)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.605\t8001\t\"ServiceBeginAcquireLicenseImpl PsmKey:A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6+App, IsSystemUsage:1\nFunction: ServiceBeginAcquireLicenseImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2304)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.605\t8002\t\"Failure Message: hr: 0x800703f0\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2324)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.605\t8001\t\"Failure Message: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp(2324)\\LicenseManager.dll!00007FFBF486A702: (caller: 00007FFBF525134D) Exception(12) tid(984) 800703F0 \u041f\u043e\u043f\u044b\u0442\u043a\u0430 \u0441\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u043d\u0435\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0439 \u0442\u043e\u043a\u0435\u043d.\n\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2348)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.606\t8001\t\"ServiceBeginAcquireLicenseImpl PsmKey:A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6+App, IsSystemUsage:1\nFunction: ServiceBeginAcquireLicenseImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2304)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.607\t8001\t\"Skipping license manager: PFN A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.611\t8001\t\"Licensing package A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6 (3)\nFunction: OneStoreApplicationLicenseManager::GetLicenseForInstalledPackage\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\onestoreapplicensemanager.cpp (120)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.611\t8001\t\"Licensing 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A (Active)\nFunction: LicenseManager::LicenseContentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\manager.cpp (88)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.611\t8001\t\"0000021F831D3050: Key Machine for content: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\nFunction: KeyMachine::KeyMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (95)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.612\t8011\t0x21f83133e68: 8380: RootMachine: Dispatch: Root:Connect => Root:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.612\t8011\t0x21f831d3070: 8380: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A: Dispatch: Key:Activate => Key:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.612\t8001\t\"0000021F831D3050: BeginLicense: Operation 3, CachedLeaseOK true, RequireServiceValidation false\nFunction: KeyMachine::DoBeginLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (819)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.612\t8012\t0x21f831d3070: 8380: Key:Initial Change: Key:NegotiatingUnleased => 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.636\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:13:57.636\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:13:57.642\t1002\tError 0x80070005 occurred while verifying known folder {62ab5d82-fdc1-4dc3-a9dd-070d1d495d97} with path 'C:\\ProgramData'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 09:13:57.650\t505\t\"Compatibility fix applied to C:\\WINDOWS\\system32\\backgroundTaskHost.exe.\nFix information: \u042f\u043d\u0434\u0435\u043a\u0441.\u041c\u0443\u0437\u0438\u043a\u0430, {071f875e-406c-4938-beaa-65f69cc573e2}, 0x80010101.\"\tInformation\tMicrosoft-Windows-Application-Experience/Program-Telemetry\tMicrosoft-Windows-Application-Experience\n05.09.2026 09:13:57.658\t100\tClipSVC service is starting.  Caller: TriggerStarted\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 09:13:57.660\t101\tClipSVC service is running.  Version 10.0.26100.9168\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 09:13:57.669\t8001\t\"Considering License ID {DE7849EA-B8E4-60D1-C780-7B0969A99E76} for content ID 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.669\t8001\t\"Decoding: {\"\"legacyProductId\"\":\"\"b7757af6-9e6d-4d21-8272-c9137a2e9145\"\"}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.669\t8001\t\"Accepting key with License ID {DE7849EA-B8E4-60D1-C780-7B0969A99E76} for Content ID 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A (first match)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (223)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.669\t8001\t\"Returning key document for contentid 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (262)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.669\t8001\t\"Getting lease for 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\nFunction: LicenseManagerCore::GetExistingLeaseAndLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (415)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.671\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2be1da80-9d39-1a56-8b4b-dca10f958cc2\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=80daf1f6-7afc-6d23-2c3c-f1e0a663029a&entitlementId=2be1da80-9d39-1a56-8b4b-dca10f958cc2&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"de7849ea-b8e4-60d1-c780-7b0969a99e76\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"80daf1f6-7afc-6d23-2c3c-f1e0a663029a\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NBLGGH0CB6D\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-09-04T15:27:12.2174791+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.671\t8001\t\"Adding lease {941FBCC0-EC32-D9CB-EB46-FC3AE38EC79B} to results\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (387)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.671\t8001\t\"Returning 1 lease documents for contentid 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.671\t8001\t\"lease = 0x831af3b8, usage = 268435456, policy = 1, operation = 3, leaseBehavior = 0, shouldContentBeDeactivated = 0\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (905)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.671\t8011\t0x21f831d3070: 8380: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A: Dispatch: Key:@LicenseDone => Key:NegotiatingUnleased\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.677\t8001\t\"lease = 0x831af3b8, leaseActive = 1, leaseBehavior = 0\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1986)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.677\t8001\t\"Lease Machine: 0000021F8312B400: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\nFunction: LeaseMachine::LeaseMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (40)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.677\t8001\t\"Set results for lease = 0x831af3b8, policy = 1, operation = 3, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.678\t8001\t\"No cached lease or key found, not renewing with service and treating this as a valid license with lease = 0x831af3b8\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (2032)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.678\t8012\t0x21f831d3070: 8380: Key:NegotiatingUnleased Change: Key:Valid => 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.678\t8011\t0x21f8312b420: 8380: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}: Dispatch: Lease:UpdateLeaseDocument => Lease:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.678\t8012\t0x21f8312b420: 8380: Lease:Initial Change: Lease:Valid => {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.678\t8001\t\"Decoding: {\"\"legacyProductId\"\":\"\"b7757af6-9e6d-4d21-8272-c9137a2e9145\"\"}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.678\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2be1da80-9d39-1a56-8b4b-dca10f958cc2\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=80daf1f6-7afc-6d23-2c3c-f1e0a663029a&entitlementId=2be1da80-9d39-1a56-8b4b-dca10f958cc2&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"de7849ea-b8e4-60d1-c780-7b0969a99e76\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"80daf1f6-7afc-6d23-2c3c-f1e0a663029a\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NBLGGH0CB6D\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-09-04T15:27:12.2174791+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.678\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2be1da80-9d39-1a56-8b4b-dca10f958cc2\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=80daf1f6-7afc-6d23-2c3c-f1e0a663029a&entitlementId=2be1da80-9d39-1a56-8b4b-dca10f958cc2&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"de7849ea-b8e4-60d1-c780-7b0969a99e76\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"80daf1f6-7afc-6d23-2c3c-f1e0a663029a\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NBLGGH0CB6D\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-09-04T15:27:12.2174791+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.678\t8001\t\"ReactiveLicensingResult: 0x00000000 for A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6, 63ms\nFunction: LogReactiveLicensingResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\telemetry.cpp (512)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.678\t8011\t0x21f831d3070: 2436: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A: Dispatch: Key:RegisterCallback => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.678\t8001\t\"Updating lease timer for {1173A7B1-89F2-09CC-0563-CDED7D7397B9} to expire @ 2026-09-05T02:52:23Z (jitter was 38.427246 minutes)\nFunction: LeaseMachine::DoUpdateLeaseTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (276)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.678\t8001\t\"Added timer for {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\nFunction: MemoryTimerService::CreateTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (57)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.678\t8011\t0x21f8312b420: 8380: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}: Dispatch: Lease:AddKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.679\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 15612) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffbf0267243, module offset: 0x17243, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x2bec9d03a40, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 09:13:57.679\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 15612) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffbf025fda9, module offset: 0xfda9, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x2bec9d03200, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 09:13:57.679\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 15612) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffbf02690c3, module offset: 0x190c3, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x2bec9d03209, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 09:13:57.679\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 15612) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffbf02606ff, module offset: 0x106ff, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x2bec9d03228, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 09:13:57.679\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 15612) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffbf02589fd, module offset: 0x89fd, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x2bec9d03220, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 09:13:57.816\t16394\tOffline downlevel migration succeeded.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 09:13:58.313\t157\tThe license with Id 2da6ca43-2e6f-1f16-05ad-a9959043ddb7 has been archived successfully.  PFM if available: Microsoft.Windows.99.X20-15863_8wekyb3d8bbwe\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 09:13:58.313\t116\t\"Application license successfully installed.\nPackage: Microsoft.Windows.99.X20-15863_8wekyb3d8bbwe\nUser Id (if available): NULL\nLicense Id: 2da6ca43-2e6f-1f16-05ad-a9959043ddb7\nAssociate Id: 2da6ca43-2e6f-1f16-05ad-a9959043ddb7\"\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 09:13:58.319\t8001\t\"Licensing content 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: OneStoreApplicationLicenseManager::ActivateLicenseForContent\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\onestoreapplicensemanager.cpp (410)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.319\t8001\t\"Licensing 807d73a3-33f2-c21b-c47a-85c313d97af9 (Active)\nFunction: LicenseManager::LicenseContentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\manager.cpp (88)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.319\t8002\t\"Capturing identity for LocalSystem, this probably isn't intended\nFunction: StoredIdentity::StoredIdentity\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\identity.cpp (536)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.319\t8001\t\"0000021F831D39B0: Key Machine for content: 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: KeyMachine::KeyMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (95)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.320\t8011\t0x21f83133e68: 8380: RootMachine: Dispatch: Root:Connect => Root:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.320\t8011\t0x21f831d39d0: 8380: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:Activate => Key:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.320\t8001\t\"0000021F831D39B0: BeginLicense: Operation 3, CachedLeaseOK true, RequireServiceValidation false\nFunction: KeyMachine::DoBeginLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (819)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.320\t8012\t0x21f831d39d0: 8380: Key:Initial Change: Key:NegotiatingUnleased => 807d73a3-33f2-c21b-c47a-85c313d97af9\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.321\t8001\t\"Considering License ID {2DA6CA43-2E6F-1F16-05AD-A9959043DDB7} for content ID 807d73a3-33f2-c21b-c47a-85c313d97af9...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.321\t8001\t\"Accepting key with License ID {2DA6CA43-2E6F-1F16-05AD-A9959043DDB7} for Content ID 807d73a3-33f2-c21b-c47a-85c313d97af9 (first match)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (223)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.321\t8001\t\"Considering License ID {8CB56148-398C-A7C4-98F2-6FDC89C2093D} for content ID 807d73a3-33f2-c21b-c47a-85c313d97af9...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.321\t8001\t\"Ignoring key for 807d73a3-33f2-c21b-c47a-85c313d97af9 with quality fffffff (0xc0ea0009) (no better than best)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (251)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.321\t8001\t\"Considering License ID {BDBB3CA5-594E-7337-A093-A9860F553465} for content ID 807d73a3-33f2-c21b-c47a-85c313d97af9...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.321\t8001\t\"Decoding: {}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.321\t8001\t\"Accepting key with License ID {BDBB3CA5-594E-7337-A093-A9860F553465} for Content ID 807d73a3-33f2-c21b-c47a-85c313d97af9 (better quality: 7f000000 vs 1fffffff)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (229)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.321\t8001\t\"Returning key document for contentid 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (262)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.321\t8001\t\"Getting lease for 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: LicenseManagerCore::GetExistingLeaseAndLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (415)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.323\t8001\t\"Ignoring otherwise matching lease ({33B013F2-4858-241D-9000-CA9374B3ADB5}) for Content ID 807D73A3-33F2-C21B-C47A-85C313D97AF9 because of quality 268435455 (0xc0ea000a)\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (396)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.323\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.324\t8001\t\"Adding lease {AE9143F3-8179-89B2-A3AF-FFC1D366D1AE} to results\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (387)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.324\t8001\t\"Returning 1 lease documents for contentid 807D73A3-33F2-C21B-C47A-85C313D97AF9\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.324\t8001\t\"lease = 0x831afa78, usage = 536870912, policy = 2147483647, operation = 3, leaseBehavior = 0, shouldContentBeDeactivated = 0\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (905)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.324\t8001\t\"lease = 0x831afa78, quality = 1073741824\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (935)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.324\t8001\t\"content is alreadyLicensed, lease is cached\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (942)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.324\t8011\t0x21f831d39d0: 8380: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:@LicenseDone => Key:NegotiatingUnleased\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.326\t8002\t\"Failure Message: hr: 0x80070490\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\misc.cpp (49)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8001\t\"lease = 0x831afa78, leaseActive = 1, leaseBehavior = 0\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1986)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8001\t\"Lease Machine: 0000021F8312A400: {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: LeaseMachine::LeaseMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (40)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8001\t\"Set results for lease = 0x831afa78, policy = 2147483647, operation = 3, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8001\t\"No cached lease or key found, not renewing with service and treating this as a valid license with lease = 0x831afa78\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (2032)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8012\t0x21f831d39d0: 8380: Key:NegotiatingUnleased Change: Key:Valid => 807d73a3-33f2-c21b-c47a-85c313d97af9\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8011\t0x21f8312a420: 8380: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:UpdateLeaseDocument => Lease:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8012\t0x21f8312a420: 8380: Lease:Initial Change: Lease:Valid => {2CE050AC-4159-AABB-AC60-9CED070AF672}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8001\t\"Decoding: {}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8011\t0x21f831d39d0: 16484: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:RegisterCallback => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8001\t\"Updating lease timer for {2CE050AC-4159-AABB-AC60-9CED070AF672} to expire @ 2026-09-11T13:58:38Z (jitter was 29.321970 minutes)\nFunction: LeaseMachine::DoUpdateLeaseTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (276)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8001\t\"Added timer for {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: MemoryTimerService::CreateTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (57)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8011\t0x21f8312a420: 8380: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:AddKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8011\t0x21f831d39d0: 8380: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:Unregistered => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8001\t\"Lease dropped\nFunction: KeyMachine::DoDropLease\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (279)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8012\t0x21f831d39d0: 8380: Key:Valid Change: Key:Invalid => 807d73a3-33f2-c21b-c47a-85c313d97af9\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8001\t\"Set results for lease = 0x0, policy = 0, operation = 0, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8011\t0x21f8312a420: 8380: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:RemoveKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8011\t0x21f8312a420: 8380: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:Unregistered => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8012\t0x21f8312a420: 8380: Lease:Valid Change: Lease:Invalid => {2CE050AC-4159-AABB-AC60-9CED070AF672}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8001\t\"Requesting lease document removal for reason 0x00000000, {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: LicenseManagerCore::DoRemoveLeaseDocumentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (1460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.328\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.328\t8001\t\"Ignoring lease removal with reason 0x00000000 because this is an offline lease\n\nFunction: ClipStorage::RemoveLeaseDocumentWithIdAndReason\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (501)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.328\t173\tProduct key from MSDM table redeemed. Result: 0x0\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 09:13:58.328\t8002\t\"Trying to remove timer {2CE050AC-4159-AABB-AC60-9CED070AF672} not in table\nFunction: MemoryTimerService::CancelTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (80)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.328\t8001\t\"Removed timer for {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: MemoryTimerService::CleanupTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (19)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.556\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:59.116\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:59.564\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:00.572\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:01.356\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:01.917\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:02.140\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:02.366\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:02.586\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:02.919\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:03.474\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:03.698\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:03.920\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:04.144\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:04.227\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:14:04.227\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:14:04.253\t4116\tStarted the Group Policy service initialization phase.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 09:14:04.257\t4115\tGroup Policy Service started.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 09:14:04.257\t5324\tGroup Policy received the notification CreateSession from Winlogon for session 0.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 09:14:04.257\t5351\tGroup policy session returned to winlogon.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 09:14:04.258\t4117\tGroup Policy Session started.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 09:14:04.260\t5351\tGroup policy session returned to winlogon.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 09:14:04.260\t4117\tGroup Policy Session started.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 09:14:04.262\t5116\tSuccessfully completed the Group Policy Service initialization phase.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 09:14:04.262\t5320\tThe Group Policy Client service is currently configured as a standalone service.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 09:14:04.262\t5320\tInitializing and reading current service configuration for the Group Policy Client service.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 09:14:04.262\t5320\tInitializing service instance state to detect previous instances of the service.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 09:14:04.262\t5321\tA previous instance of the Group Policy Client Service was detected. Parameter: b6436654-42c0-4fef-910e-4de52610333d\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 09:14:04.272\t5117\tGroup policy session completed successfully.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 09:14:04.273\t5117\tGroup policy session completed successfully.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 09:14:04.480\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:06.157\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:06.605\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:07.503\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:07.725\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:07.949\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:08.510\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:09.184\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:09.406\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:09.849\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:10.072\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:10.406\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:11.406\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:11.853\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:12.079\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:12.299\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:13.299\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:13.856\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:14.973\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:16.200\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:16.534\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:16.757\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:17.088\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:17.424\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:18.095\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:18.544\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:18.879\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:19.102\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:19.549\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:22.547\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:23.969\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:24.195\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:25.725\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:26.543\t10000\tStarting session 1 - \u200e2026\u200e-\u200e09\u200e-\u200e05T02:14:26.542618500Z.\tInformation\tApplication\tMicrosoft-Windows-RestartManager\n05.09.2026 09:14:26.820\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:27.584\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:27.915\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:28.048\t16384\tSuccessfully scheduled Software Protection service for re-start at 2126-08-12T02:14:28Z. Reason: RulesEngine.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 09:14:28.246\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:29.874\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:36.251\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:14:36.266\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:14:36.266\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:14:36.288\t505\t\"Compatibility fix applied to C:\\WINDOWS\\system32\\backgroundTaskHost.exe.\nFix information: Microsoft Apps, {81ecdb97-5112-41af-9a59-5ba9444f4270}, 0x80010101.\"\tInformation\tMicrosoft-Windows-Application-Experience/Program-Telemetry\tMicrosoft-Windows-Application-Experience\n05.09.2026 09:14:45.042\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:14:45.042\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:14:45.129\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:14:45.129\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:14:46.536\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:53.906\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:14:53.906\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:14:53.906\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:14:53.916\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:14:57.743\t8001\t\"Invoking license manager because license/lease polling time up: PFN A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (361)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:14:57.744\t8001\t\"ServicePackageRundownNotificationImpl PsmKey:A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6+App, sid:S-1-5-21-3712849175-2219398513-4278588552-1006\nFunction: ServicePackageRundownNotificationImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2587)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:14:57.744\t8011\t0x21f831d3070: 8380: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A: Dispatch: Key:Unregistered => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:14:57.744\t8001\t\"Lease dropped\nFunction: KeyMachine::DoDropLease\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (279)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:14:57.744\t8012\t0x21f831d3070: 8380: Key:Valid Change: Key:Invalid => 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:14:57.744\t8001\t\"Set results for lease = 0x0, policy = 0, operation = 0, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:14:57.744\t8011\t0x21f8312b420: 16484: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}: Dispatch: Lease:RemoveKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:14:57.744\t8011\t0x21f8312b420: 16484: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}: Dispatch: Lease:Unregistered => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:14:57.744\t8012\t0x21f8312b420: 16484: Lease:Valid Change: Lease:Invalid => {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:14:57.744\t8001\t\"Requesting lease document removal for reason 0x00000000, {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\nFunction: LicenseManagerCore::DoRemoveLeaseDocumentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (1460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:14:57.746\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2be1da80-9d39-1a56-8b4b-dca10f958cc2\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=80daf1f6-7afc-6d23-2c3c-f1e0a663029a&entitlementId=2be1da80-9d39-1a56-8b4b-dca10f958cc2&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"de7849ea-b8e4-60d1-c780-7b0969a99e76\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"80daf1f6-7afc-6d23-2c3c-f1e0a663029a\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NBLGGH0CB6D\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-09-04T15:27:12.2174791+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:14:57.746\t8001\t\"Ignoring lease removal with reason 0x00000000 because this is an offline lease\n\nFunction: ClipStorage::RemoveLeaseDocumentWithIdAndReason\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (501)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:14:57.747\t8002\t\"Trying to remove timer {1173A7B1-89F2-09CC-0563-CDED7D7397B9} not in table\nFunction: MemoryTimerService::CancelTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (80)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:14:57.747\t8001\t\"Removed timer for {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\nFunction: MemoryTimerService::CleanupTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (19)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:14:58.506\t10006\tApplication or service 'Microsoft Office SDX Helper' could not be shut down.\tError\tApplication\tMicrosoft-Windows-RestartManager\n05.09.2026 09:14:58.522\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:58.524\t10002\tShutting down application or service 'Microsoft Office SDX Helper'.\tInformation\tApplication\tMicrosoft-Windows-RestartManager\n05.09.2026 09:14:59.189\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:59.633\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:59.971\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:00.976\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:01.196\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:01.531\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:01.865\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:02.308\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:04.199\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:04.405\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:04.605\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:05.604\t8100\tStarting validation and setting the Trust Label on package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:15:05.605\t8106\tPackage Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe has Trust Label already. Flags: 0x103\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:15:05.605\t8101\tFinished validation and setting the Trust Label on package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:15:06.787\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:07.108\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:09.187\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:09.635\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:10.402\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:10.936\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:11.156\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:12.448\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:12.663\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:14.506\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:14.841\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:16.360\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:18.520\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:19.480\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:19.690\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:20.994\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:21.865\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:22.377\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:22.382\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:29.556\t1010\t\"Device SWD\\PRINTENUM\\{1F5A1788-40BD-4620-B65B-46330E9E2257} has been surprise removed as it is reported as missing on the bus.\nCount of devices removed: 1\"\tInformation\tMicrosoft-Windows-Kernel-PnP/Device Management\tMicrosoft-Windows-Kernel-PnP\n05.09.2026 09:15:29.568\t420\t\"Device SWD\\PRINTENUM\\{1F5A1788-40BD-4620-B65B-46330E9E2257} was deleted.\n\nClass GUID: {1ed2bbf9-11f0-4084-b21f-ad83a8e6dcdc}\"\tInformation\tMicrosoft-Windows-Kernel-PnP/Configuration\tMicrosoft-Windows-Kernel-PnP\n05.09.2026 09:15:29.707\t1013\t\"Windows Search Service stopped normally.\n\"\tInformation\tApplication\tMicrosoft-Windows-Search\n05.09.2026 09:15:30.175\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:15:30.175\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:15:30.312\t1003\t\"The Windows Search Service started.\n\"\tInformation\tApplication\tMicrosoft-Windows-Search\n05.09.2026 09:15:30.315\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-544\n\tGroup Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u044b\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x364\n\tProcess Name:\t\tC:\\Windows\\System32\\SearchIndexer.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:15:30.316\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-551\n\tGroup Name:\t\t\u041e\u043f\u0435\u0440\u0430\u0442\u043e\u0440\u044b \u0430\u0440\u0445\u0438\u0432\u0430\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x364\n\tProcess Name:\t\tC:\\Windows\\System32\\SearchIndexer.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:15:30.333\t501\t\"A process has deleted a USN journal on a volume.\n\n           Process: SearchIndexer.\n           Volume Id: {23606dfe-da07-4ad7-8798-8deaced0a66e}\n           Volume Name: C:\n           Journal Id: 0x1DC755BE25CD000\n           Current USN: 0x0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 09:15:30.339\t501\t\"A process has deleted a USN journal on a volume.\n\n           Process: SearchIndexer.\n           Volume Id: {b4de30fc-d998-46fa-9187-a8f915fd81fc}\n           Volume Name: D:\n           Journal Id: 0x1DCE9F9F77DCD9D\n           Current USN: 0x0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 09:15:30.430\t501\t\"A process has deleted a USN journal on a volume.\n\n           Process: SearchIndexer.\n           Volume Id: {5285d7ae-0000-0000-0000-300432000000}\n           Volume Name: F:\n           Journal Id: 0x19DB31D0AD8ABD4\n           Current USN: 0x0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 09:15:37.136\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:37.140\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:44.091\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:45.508\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:49.218\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:52.159\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:56.727\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:59.718\t16394\tOffline downlevel migration succeeded.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 09:15:59.976\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:15:59.976\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:16:00.036\t1040\tBeginning a Windows Installer transaction: {90160000-008C-0000-1000-0000000FF1CE}. Client Process Id: 11964.\tInformation\tApplication\tMsiInstaller\n05.09.2026 09:16:03.155\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:03.374\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:03.584\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:09.380\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:09.602\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:10.149\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:10.580\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:12.212\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:12.537\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:12.857\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:12.862\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:14.461\t11724\t\u041f\u0440\u043e\u0434\u0443\u043a\u0442: Office 16 Click-to-Run Extensibility Component -- \u0423\u0434\u0430\u043b\u0435\u043d\u0438\u0435 \u0437\u0430\u0432\u0435\u0440\u0448\u0435\u043d\u043e \u0443\u0441\u043f\u0435\u0448\u043d\u043e.\tInformation\tApplication\tMsiInstaller\n05.09.2026 09:16:14.462\t1034\tWindows Installer removed the product. Product Name: Office 16 Click-to-Run Extensibility Component. Product Version: 16.0.20326.20072. Product Language: 0. Manufacturer: Microsoft Corporation. Removal success or error status: 0.\tInformation\tApplication\tMsiInstaller\n05.09.2026 09:16:14.479\t1042\tEnding a Windows Installer transaction: {90160000-008C-0000-1000-0000000FF1CE}. Client Process Id: 11964.\tInformation\tApplication\tMsiInstaller\n05.09.2026 09:16:14.497\t1040\tBeginning a Windows Installer transaction: {90160000-008C-0419-1000-0000000FF1CE}. Client Process Id: 11964.\tInformation\tApplication\tMsiInstaller\n05.09.2026 09:16:17.640\t11724\t\u041f\u0440\u043e\u0434\u0443\u043a\u0442: Office 16 Click-to-Run Localization Component -- \u0423\u0434\u0430\u043b\u0435\u043d\u0438\u0435 \u0437\u0430\u0432\u0435\u0440\u0448\u0435\u043d\u043e \u0443\u0441\u043f\u0435\u0448\u043d\u043e.\tInformation\tApplication\tMsiInstaller\n05.09.2026 09:16:17.641\t1034\tWindows Installer removed the product. Product Name: Office 16 Click-to-Run Localization Component. Product Version: 16.0.20326.20100. Product Language: 1049. Manufacturer: Microsoft Corporation. Removal success or error status: 0.\tInformation\tApplication\tMsiInstaller\n05.09.2026 09:16:17.647\t1042\tEnding a Windows Installer transaction: {90160000-008C-0419-1000-0000000FF1CE}. Client Process Id: 11964.\tInformation\tApplication\tMsiInstaller\n05.09.2026 09:16:19.685\t1002\tError 0x80070002 occurred while verifying known folder {c4900540-2379-4c75-844b-64e6faf8716b} with path 'C:\\Users\\Public\\Pictures\\Sample Pictures'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 09:16:19.686\t1002\tError 0x80070002 occurred while verifying known folder {b250c668-f57d-4ee1-a63c-290ee7d1aa1f} with path 'C:\\Users\\Public\\Music\\Sample Music'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 09:16:19.688\t1002\tError 0x80070002 occurred while verifying known folder {859ead94-2e85-48ad-a71a-0969cb56a6cd} with path 'C:\\Users\\Public\\Videos\\Sample Videos'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 09:16:19.688\t1002\tError 0x80070002 occurred while verifying known folder {a440879f-87a0-4f7d-b700-0207b966194a} with path 'C:\\ProgramData\\Microsoft\\Windows\\Start Menu Places'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 09:16:19.689\t1002\tError 0x80070002 occurred while verifying known folder {b88f4daa-e7bd-49a9-b74d-02885a5dc765} with path 'C:\\WINDOWS\\system32\\config\\systemprofile\\AppData\\Roaming\\Microsoft\\Crypto'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 09:16:19.691\t1002\tError 0x80070002 occurred while verifying known folder {10c07cd0-ef91-4567-b850-448b77cb37f9} with path 'C:\\WINDOWS\\system32\\config\\systemprofile\\AppData\\Roaming\\Microsoft\\Protect'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 09:16:19.693\t1002\tError 0x80070002 occurred while verifying known folder {915221fb-9efe-4bda-8fd7-f78dca774f87} with path 'C:\\WINDOWS\\system32\\config\\systemprofile\\AppData\\Roaming\\Microsoft\\Credentials'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 09:16:29.961\t16384\tSuccessfully scheduled Software Protection service for re-start at 2126-08-12T02:16:29Z. Reason: RulesEngine.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 09:16:30.868\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:30.880\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:31.094\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:31.305\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:31.634\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:31.852\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:32.063\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:32.277\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:32.831\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:33.053\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:33.375\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:33.707\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:34.042\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:34.798\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:36.224\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:36.443\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:36.877\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:37.530\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:38.080\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:38.085\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:38.599\t28017\tAppResolver Scan Started.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:16:38.649\t28018\tAppResolver Scan Stopped.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:16:38.650\t28019\tAppResolver Cache Committed.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:16:38.658\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:16:46.925\t603\tStarted deployment DeprovisionPackageOperation operation on a package with main parameter Microsoft.OfficePushNotificationUtility_8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:46.943\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_4.rslc for DeprovisionPackageOperation Operation on Package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:46.944\t607\tDeployment DeprovisionPackageOperation operation on package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1006.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.079\t221\tANALYZE command has run; database statistics are updated [Partition=1, ProcessId=3720, Scope=(database)]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.140\t221\tANALYZE command has run; database statistics are updated [Partition=2, ProcessId=3720, Scope=(database)]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.147\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.153\t400\tDeployment DeprovisionPackageOperation operation with target volume C: on Package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.177\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.181\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe and Options RemoveForAllUsers and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.212\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_5.rslc for Remove Operation on Package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.214\t607\tDeployment Remove operation on package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1002.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.223\t855\tFinished resolving action lists. DeploymentRequest action lists: removePackageList: Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe deferredRemovePackageFullNames: Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.233\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_6.rslc for Remove Operation on Package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.272\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_7.rslc for Remove Operation on Package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.276\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.276\t818\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1002.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.288\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_8.rslc for Remove Operation on Package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.316\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_9.rslc for Remove Operation on Package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.320\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_10.rslc for Remove Operation on Package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.339\t400\tDeployment Remove operation with target volume C: on Package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe from:  (Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.386\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.390\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.395\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_11.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.397\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.397\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.399\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.402\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_12.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.420\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.420\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.425\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.427\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_13.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.429\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.430\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.431\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.435\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_14.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.436\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.438\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.460\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.461\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.471\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.472\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_15.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.473\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.475\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.478\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.480\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_16.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.482\t607\tDeployment Remove operation on package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1001.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.487\t855\tFinished resolving action lists. DeploymentRequest action lists: removePackageList: Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe deferredRemovePackageFullNames: Microsoft.UI.Xaml.2.4_2.42007.9001.0_x86__8wekyb3d8bbwe Microsoft.Services.Store.Engagement_10.0.23012.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.4_4000.1136.2333.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.519\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.522\t818\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1001.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.548\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.549\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.551\t400\tDeployment Remove operation with target volume C: on Package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe from:  (Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.577\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.580\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.UI.Xaml.2.4_2.42007.9001.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.580\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.583\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.585\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.586\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_17.rslc for Remove Operation on Package Microsoft.UI.Xaml.2.4_2.42007.9001.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.589\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.Services.Store.Engagement_10.0.23012.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.594\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_18.rslc for Remove Operation on Package Microsoft.Services.Store.Engagement_10.0.23012.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.596\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.600\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.601\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.601\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_19.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.603\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.603\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.4_4000.1136.2333.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.605\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.608\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_20.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.4_4000.1136.2333.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.609\t607\tDeployment Remove operation on package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1007.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.616\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.629\t855\tFinished resolving action lists. DeploymentRequest action lists: removePackageList: Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe deferredRemovePackageFullNames: Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.673\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.677\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.692\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.694\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.696\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.712\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.713\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.729\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.733\t607\tDeployment Remove operation on package Microsoft.UI.Xaml.2.4_2.42007.9001.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.735\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.735\t627\tWindows cannot remove Microsoft.UI.Xaml.2.4_2.42007.9001.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.735\t818\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1007.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.753\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.756\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.UI.Xaml.2.4_2.42007.9001.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.770\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.772\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.775\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.785\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.787\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.800\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.802\t607\tDeployment Remove operation on package Microsoft.Services.Store.Engagement_10.0.23012.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.803\t627\tWindows cannot remove Microsoft.Services.Store.Engagement_10.0.23012.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.819\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.821\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.Services.Store.Engagement_10.0.23012.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.842\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.844\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.4_4000.1136.2333.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.846\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.4_4000.1136.2333.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.865\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.867\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.4_4000.1136.2333.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.883\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.893\t400\tDeployment Remove operation with target volume C: on Package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe from:  (Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.914\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.917\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.924\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_21.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.927\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.927\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.929\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.938\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_22.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.941\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.947\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_23.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.949\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.950\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.952\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.955\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_24.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.957\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.959\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.960\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.965\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_25.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.968\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.972\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.975\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_26.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.976\t607\tDeployment Remove operation on package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1006.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.976\t626\tDeployment Remove operation on package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe has been requeued for user SID S-1-5-21-3712849175-2219398513-4278588552-1006.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.987\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.987\t607\tDeployment Remove operation on package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1003.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.994\t855\tFinished resolving action lists. DeploymentRequest action lists: removePackageList: Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe deferredRemovePackageFullNames: Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.015\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.016\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.031\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.033\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.035\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.050\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.052\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.068\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.071\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.073\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.093\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.095\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.115\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.118\t818\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1003.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.140\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.142\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.146\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.162\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.163\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.177\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.179\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.181\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.198\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.199\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.210\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.218\t400\tDeployment Remove operation with target volume C: on Package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe from:  (Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.235\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.238\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.245\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_27.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.246\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.247\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.250\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.254\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_28.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.257\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.265\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_29.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.268\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.270\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.272\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.274\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_30.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.275\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.277\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.280\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.286\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_31.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.289\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.294\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.296\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_32.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.298\t607\tDeployment Remove operation on package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1006.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.298\t626\tDeployment Remove operation on package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe has been requeued for user SID S-1-5-21-3712849175-2219398513-4278588552-1006.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.316\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.319\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.338\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.341\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.345\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.351\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.352\t607\tDeployment Remove operation on package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1009.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.354\t855\tFinished resolving action lists. DeploymentRequest action lists: removePackageList: Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe deferredRemovePackageFullNames: Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.378\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.379\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.397\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.400\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.403\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.423\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.424\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.444\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.448\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.450\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.472\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.474\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.491\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.494\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.497\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.520\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.522\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.540\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.603\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.607\t818\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1009.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.638\t400\tDeployment Remove operation with target volume C: on Package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe from:  (Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.661\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.666\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.674\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_33.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.675\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.676\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.677\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.683\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_34.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.684\t607\tDeployment Remove operation on package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1006.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.699\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.702\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.722\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.726\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.729\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.747\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.748\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.766\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.808\t855\tFinished resolving action lists. DeploymentRequest action lists: removePackageList: Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.835\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.835\t617\tSuccessfully updated the status for package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe and user S-1-5-21-3712849175-2219398513-4278588552-1006 (Clear=0x0, Set=0x20).\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.953\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\tMicrosoft.OfficePushNotificationUtility_8wekyb3d8bbweS-1-5-21-3712849175-2219398513-4278588552-1006-Out-Allow-InternetClient\n\tRule Name:\tOfficePushNotificationsUtility\n\tModifying User:\tS-1-5-80-3088073201-1464728630-1879813800-1107566885-823218052\n\tModifying Application:\tC:\\WINDOWS\\System32\\svchost.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 09:16:48.954\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\tMicrosoft.OfficePushNotificationUtility_8wekyb3d8bbweS-1-5-21-3712849175-2219398513-4278588552-1006-Out-Block\n\tRule Name:\tOfficePushNotificationsUtility\n\tModifying User:\tS-1-5-80-3088073201-1464728630-1879813800-1107566885-823218052\n\tModifying Application:\tC:\\WINDOWS\\System32\\svchost.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 09:16:48.955\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\tMicrosoft.OfficePushNotificationUtility_8wekyb3d8bbweS-1-5-21-3712849175-2219398513-4278588552-1006-In-Block\n\tRule Name:\tOfficePushNotificationsUtility\n\tModifying User:\tS-1-5-80-3088073201-1464728630-1879813800-1107566885-823218052\n\tModifying Application:\tC:\\WINDOWS\\System32\\svchost.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 09:16:48.956\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\tMicrosoft.OfficePushNotificationUtility_8wekyb3d8bbweS-1-5-21-3712849175-2219398513-4278588552-1006-Out-Allow-AllCapabilities\n\tRule Name:\tOfficePushNotificationsUtility\n\tModifying User:\tS-1-5-80-3088073201-1464728630-1879813800-1107566885-823218052\n\tModifying Application:\tC:\\WINDOWS\\System32\\svchost.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 09:16:49.148\t28017\tAppResolver Scan Started.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:16:49.194\t28018\tAppResolver Scan Stopped.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:16:49.195\t28019\tAppResolver Cache Committed.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:16:49.201\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:16:49.265\t1024\tPackage Microsoft.OfficePushNotificationUtility_8wekyb3d8bbwe for user S-1-5-21-3712849175-2219398513-4278588552-1006 successfully deprovisioned\tInformation\tMicrosoft-Windows-Privacy-Auditing/Operational\tMicrosoft-Windows-Privacy-Auditing\n05.09.2026 09:16:49.323\t2415\tAn application was unregistered with the following parameters: Microsoft.OfficePushNotificationUtility_8wekyb3d8bbwe!OPushUtil [AppUserModelId] The operation completed successfully. [ErrorCode]\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:16:49.335\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:49.335\t617\tSuccessfully updated the status for package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe and user S-1-5-21-3712849175-2219398513-4278588552-1006 (Clear=0xFFFFFFFF, Set=0x0).\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.347\t41\tSuccessfully deleted AppContainer Microsoft.OfficePushNotificationUtility_8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:16:49.390\t2562\t\tInformation\tApplication\tMicrosoft-Windows-AppXDeploymentServer/Operational\n05.09.2026 09:16:49.501\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:49.506\t818\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1006.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.513\t400\tDeployment Remove operation with target volume C: on Package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe from:  (Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.522\t472\tMoving package folder \\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe to \\\\?\\C:\\Program Files\\WindowsApps\\Deleted\\Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe09ad87a5-952f-438d-a535-763f10d07937. Result: 0x0.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.554\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:49.560\t603\tStarted deployment DeprovisionPackageOperation operation on a package with main parameter aimgr_8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.569\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_35.rslc for DeprovisionPackageOperation Operation on Package aimgr_0.20.61.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.570\t607\tDeployment DeprovisionPackageOperation operation on package aimgr_0.20.61.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1006.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.602\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:49.606\t400\tDeployment DeprovisionPackageOperation operation with target volume C: on Package aimgr_0.20.61.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.622\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:49.626\t603\tStarted deployment Remove operation on a package with main parameter aimgr_0.20.61.0_x64__8wekyb3d8bbwe and Options RemoveForAllUsers and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.632\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_36.rslc for Remove Operation on Package aimgr_0.20.61.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.633\t607\tDeployment Remove operation on package aimgr_0.20.61.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1002.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.634\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_37.rslc for Remove Operation on Package aimgr_0.20.61.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.637\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_38.rslc for Remove Operation on Package aimgr_0.20.61.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.640\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_39.rslc for Remove Operation on Package aimgr_0.20.61.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.642\t855\tFinished resolving action lists. DeploymentRequest action lists: removePackageList: aimgr_0.20.61.0_x64__8wekyb3d8bbwe deferredRemovePackageFullNames: Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.643\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_40.rslc for Remove Operation on Package aimgr_0.20.61.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.646\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_41.rslc for Remove Operation on Package aimgr_0.20.61.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.685\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:49.688\t818\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1002.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.728\t400\tDeployment Remove operation with target volume C: on Package aimgr_0.20.61.0_x64__8wekyb3d8bbwe from:  (aimgr_0.20.61.0_x64__8wekyb3d8bbwe)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.745\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:49.749\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.755\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_42.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.757\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.757\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.759\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.762\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_43.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.765\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.769\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_44.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.771\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.774\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:49.775\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.776\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_45.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.778\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.780\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.782\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.801\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_46.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.815\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:49.815\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.816\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.820\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_47.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.821\t607\tDeployment Remove operation on package aimgr_0.20.61.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1001.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.821\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.824\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.829\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:49.856\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:49.857\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.875\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:49.880\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.882\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.886\t855\tFinished resolving action lists. DeploymentRequest action lists: removePackageList: aimgr_0.20.61.0_x64__8wekyb3d8bbwe deferredRemovePackageFullNames: Microsoft.UI.Xaml.2.4_2.42007.9001.0_x86__8wekyb3d8bbwe Microsoft.Services.Store.Engagement_10.0.23012.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.4_4000.1136.2333.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.919\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:49.922\t818\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1001.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.925\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:49.941\t400\tDeployment Remove operation with target volume C: on Package aimgr_0.20.61.0_x64__8wekyb3d8bbwe from:  (aimgr_0.20.61.0_x64__8wekyb3d8bbwe)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.963\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:49.965\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.979\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:49.983\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.986\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.009\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.010\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.029\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.033\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.034\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.048\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.049\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.062\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.093\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.096\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.UI.Xaml.2.4_2.42007.9001.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.102\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_48.rslc for Remove Operation on Package Microsoft.UI.Xaml.2.4_2.42007.9001.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.104\t607\tDeployment Remove operation on package Microsoft.UI.Xaml.2.4_2.42007.9001.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.104\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.Services.Store.Engagement_10.0.23012.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.106\t627\tWindows cannot remove Microsoft.UI.Xaml.2.4_2.42007.9001.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.112\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_49.rslc for Remove Operation on Package Microsoft.Services.Store.Engagement_10.0.23012.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.114\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.120\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_50.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.122\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.122\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.4_4000.1136.2333.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.125\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.UI.Xaml.2.4_2.42007.9001.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.130\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_51.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.4_4000.1136.2333.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.131\t607\tDeployment Remove operation on package aimgr_0.20.61.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1007.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.132\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.4_4000.1136.2333.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.134\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.4_4000.1136.2333.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.147\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.166\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.168\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.4_4000.1136.2333.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.186\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.189\t607\tDeployment Remove operation on package Microsoft.Services.Store.Engagement_10.0.23012.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.193\t627\tWindows cannot remove Microsoft.Services.Store.Engagement_10.0.23012.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.209\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.211\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.Services.Store.Engagement_10.0.23012.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.227\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.230\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.233\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.237\t855\tFinished resolving action lists. DeploymentRequest action lists: removePackageList: aimgr_0.20.61.0_x64__8wekyb3d8bbwe deferredRemovePackageFullNames: Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.268\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.271\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.290\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.339\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.340\t818\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1007.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.377\t400\tDeployment Remove operation with target volume C: on Package aimgr_0.20.61.0_x64__8wekyb3d8bbwe from:  (aimgr_0.20.61.0_x64__8wekyb3d8bbwe)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.397\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.404\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.409\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_52.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.412\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.412\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.413\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.417\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_53.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.420\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.425\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_54.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.428\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.431\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.432\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.432\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_55.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.434\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.435\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.436\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.440\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_56.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.443\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.446\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.447\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_57.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.448\t607\tDeployment Remove operation on package aimgr_0.20.61.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1009.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.469\t855\tFinished resolving action lists. DeploymentRequest action lists: removePackageList: aimgr_0.20.61.0_x64__8wekyb3d8bbwe deferredRemovePackageFullNames: Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.475\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.477\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.491\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.494\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.495\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.509\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.510\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.524\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.528\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.531\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.547\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.549\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.565\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.568\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.570\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.585\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.586\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.601\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.605\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.606\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.624\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.626\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.654\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.655\t818\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1009.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.691\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.695\t400\tDeployment Remove operation with target volume C: on Package aimgr_0.20.61.0_x64__8wekyb3d8bbwe from:  (aimgr_0.20.61.0_x64__8wekyb3d8bbwe)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.714\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.719\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.725\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_58.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.726\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.727\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.728\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.732\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_59.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.734\t607\tDeployment Remove operation on package aimgr_0.20.61.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1003.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.748\t855\tFinished resolving action lists. DeploymentRequest action lists: removePackageList: aimgr_0.20.61.0_x64__8wekyb3d8bbwe deferredRemovePackageFullNames: Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.754\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.755\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.773\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.776\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.778\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.794\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.795\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.808\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.846\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.847\t818\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1003.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.882\t400\tDeployment Remove operation with target volume C: on Package aimgr_0.20.61.0_x64__8wekyb3d8bbwe from:  (aimgr_0.20.61.0_x64__8wekyb3d8bbwe)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.905\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.911\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.917\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_60.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.918\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.919\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.920\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.925\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_61.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.928\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.934\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_62.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.937\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.938\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.939\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.944\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_63.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.946\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.948\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.950\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.954\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_64.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.957\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.960\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.964\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_65.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.965\t607\tDeployment Remove operation on package aimgr_0.20.61.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1006.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.979\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.981\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.001\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:51.004\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.007\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.040\t855\tFinished resolving action lists. DeploymentRequest action lists: removePackageList: aimgr_0.20.61.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.042\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:51.043\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.043\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.046\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.062\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:51.065\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.083\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:51.086\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.088\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.107\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:51.108\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.126\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:51.128\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.130\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.147\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:51.149\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.166\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:51.198\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:51.220\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:51.220\t617\tSuccessfully updated the status for package aimgr_0.20.61.0_x64__8wekyb3d8bbwe and user S-1-5-21-3712849175-2219398513-4278588552-1006 (Clear=0x0, Set=0x20).\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.292\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\taimgr_8wekyb3d8bbweS-1-5-21-3712849175-2219398513-4278588552-1006-Out-Block\n\tRule Name:\tLocal AI Manager for Microsoft 365\n\tModifying User:\tS-1-5-80-3088073201-1464728630-1879813800-1107566885-823218052\n\tModifying Application:\tC:\\WINDOWS\\System32\\svchost.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 09:16:51.293\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\taimgr_8wekyb3d8bbweS-1-5-21-3712849175-2219398513-4278588552-1006-In-Block\n\tRule Name:\tLocal AI Manager for Microsoft 365\n\tModifying User:\tS-1-5-80-3088073201-1464728630-1879813800-1107566885-823218052\n\tModifying Application:\tC:\\WINDOWS\\System32\\svchost.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 09:16:51.517\t1024\tPackage aimgr_8wekyb3d8bbwe for user S-1-5-21-3712849175-2219398513-4278588552-1006 successfully deprovisioned\tInformation\tMicrosoft-Windows-Privacy-Auditing/Operational\tMicrosoft-Windows-Privacy-Auditing\n05.09.2026 09:16:51.556\t2415\tAn application was unregistered with the following parameters: aimgr_8wekyb3d8bbwe!aimgr [AppUserModelId] The operation completed successfully. [ErrorCode]\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:16:51.563\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:51.564\t617\tSuccessfully updated the status for package aimgr_0.20.61.0_x64__8wekyb3d8bbwe and user S-1-5-21-3712849175-2219398513-4278588552-1006 (Clear=0xFFFFFFFF, Set=0x0).\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.571\t41\tSuccessfully deleted AppContainer aimgr_8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:16:51.605\t2562\t\tInformation\tApplication\tMicrosoft-Windows-AppXDeploymentServer/Operational\n05.09.2026 09:16:51.703\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:51.708\t818\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1006.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.718\t400\tDeployment Remove operation with target volume C: on Package aimgr_0.20.61.0_x64__8wekyb3d8bbwe from:  (aimgr_0.20.61.0_x64__8wekyb3d8bbwe)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.729\t472\tMoving package folder \\\\?\\C:\\Program Files\\WindowsApps\\aimgr_0.20.61.0_x64__8wekyb3d8bbwe to \\\\?\\C:\\Program Files\\WindowsApps\\Deleted\\aimgr_0.20.61.0_x64__8wekyb3d8bbweb30db7cd-a4ad-4d63-a081-6ed847affaf5. Result: 0x0.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.753\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:51.760\t603\tStarted deployment DeprovisionPackageOperation operation on a package with main parameter Microsoft.Office.ActionsServer_8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.769\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_66.rslc for DeprovisionPackageOperation Operation on Package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.770\t607\tDeployment DeprovisionPackageOperation operation on package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1006.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.814\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:51.819\t400\tDeployment DeprovisionPackageOperation operation with target volume C: on Package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.838\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:51.843\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe and Options RemoveForAllUsers and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.851\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_67.rslc for Remove Operation on Package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.852\t607\tDeployment Remove operation on package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1002.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.854\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_68.rslc for Remove Operation on Package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.856\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_69.rslc for Remove Operation on Package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.859\t855\tFinished resolving action lists. DeploymentRequest action lists: removePackageList: Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe deferredRemovePackageFullNames: Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.860\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_70.rslc for Remove Operation on Package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.863\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_71.rslc for Remove Operation on Package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.868\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_72.rslc for Remove Operation on Package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.894\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:51.895\t818\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1002.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.933\t400\tDeployment Remove operation with target volume C: on Package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe from:  (Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.957\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:51.961\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.967\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_73.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.969\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.971\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.973\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.975\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_74.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.978\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.985\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_75.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.989\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.994\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:51.997\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_76.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.000\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.002\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.007\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_77.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.009\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.012\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.013\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.020\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_78.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.022\t607\tDeployment Remove operation on package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1003.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.051\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.053\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.055\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.059\t855\tFinished resolving action lists. DeploymentRequest action lists: removePackageList: Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe deferredRemovePackageFullNames: Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.059\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.082\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.084\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.086\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.088\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.091\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.103\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.130\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.157\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.160\t818\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1003.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.206\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.208\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.216\t400\tDeployment Remove operation with target volume C: on Package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe from:  (Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.226\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.229\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.230\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.246\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.247\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.264\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.267\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.269\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.285\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.287\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.301\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.331\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.338\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.345\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_79.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.347\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.347\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.349\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.355\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_80.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.359\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.366\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_81.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.369\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.374\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.375\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_82.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.376\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.376\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.377\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.378\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.380\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_83.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.381\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.385\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_84.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.386\t607\tDeployment Remove operation on package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1001.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.389\t855\tFinished resolving action lists. DeploymentRequest action lists: removePackageList: Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe deferredRemovePackageFullNames: Microsoft.UI.Xaml.2.4_2.42007.9001.0_x86__8wekyb3d8bbwe Microsoft.Services.Store.Engagement_10.0.23012.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.4_4000.1136.2333.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.407\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.407\t818\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1001.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.414\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.417\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.424\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.426\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.427\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.435\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.435\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.441\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.443\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.444\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.453\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.454\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.461\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.462\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.463\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.472\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.473\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.482\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.482\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.484\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.485\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.494\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.495\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.502\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.515\t400\tDeployment Remove operation with target volume C: on Package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe from:  (Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.527\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.529\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.UI.Xaml.2.4_2.42007.9001.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.534\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_85.rslc for Remove Operation on Package Microsoft.UI.Xaml.2.4_2.42007.9001.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.535\t607\tDeployment Remove operation on package Microsoft.UI.Xaml.2.4_2.42007.9001.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.536\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.Services.Store.Engagement_10.0.23012.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.536\t627\tWindows cannot remove Microsoft.UI.Xaml.2.4_2.42007.9001.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.539\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_86.rslc for Remove Operation on Package Microsoft.Services.Store.Engagement_10.0.23012.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.540\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.543\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_87.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.545\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.4_4000.1136.2333.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.546\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.546\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.UI.Xaml.2.4_2.42007.9001.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.548\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_88.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.4_4000.1136.2333.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.548\t607\tDeployment Remove operation on package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1007.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.549\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.4_4000.1136.2333.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.550\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.4_4000.1136.2333.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.555\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.570\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.571\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.4_4000.1136.2333.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.578\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.579\t607\tDeployment Remove operation on package Microsoft.Services.Store.Engagement_10.0.23012.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.580\t627\tWindows cannot remove Microsoft.Services.Store.Engagement_10.0.23012.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.583\t855\tFinished resolving action lists. DeploymentRequest action lists: removePackageList: Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe deferredRemovePackageFullNames: Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.600\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.602\t818\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1007.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.620\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.621\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.Services.Store.Engagement_10.0.23012.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.628\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.629\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.630\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.637\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.638\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.644\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.660\t400\tDeployment Remove operation with target volume C: on Package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe from:  (Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.670\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.673\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.676\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_89.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.677\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.679\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.680\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.681\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_90.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.682\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.685\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_91.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.687\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.690\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_92.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.690\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.691\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.691\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.691\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.692\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.694\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_93.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.695\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.699\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_94.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.699\t607\tDeployment Remove operation on package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1009.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.699\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.701\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.702\t855\tFinished resolving action lists. DeploymentRequest action lists: removePackageList: Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe deferredRemovePackageFullNames: Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.702\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.703\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.712\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.712\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.719\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.721\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.722\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.730\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.731\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.747\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.749\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.751\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.758\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.758\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.766\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.781\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.782\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.783\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.791\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.792\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.798\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.818\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.819\t818\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1009.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.831\t400\tDeployment Remove operation with target volume C: on Package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe from:  (Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.841\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.844\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.847\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_95.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.848\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.848\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.849\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.849\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.852\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_96.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.853\t607\tDeployment Remove operation on package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1006.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.859\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.860\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.868\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.870\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.871\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.881\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.889\t855\tFinished resolving action lists. DeploymentRequest action lists: removePackageList: Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.897\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.899\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.899\t617\tSuccessfully updated the status for package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe and user S-1-5-21-3712849175-2219398513-4278588552-1006 (Clear=0x0, Set=0x20).\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.921\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.932\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\tMicrosoft.Office.ActionsServer_8wekyb3d8bbweS-1-5-21-3712849175-2219398513-4278588552-1006-Out-Allow-InternetClient\n\tRule Name:\tMicrosoft.Office.ActionsServer\n\tModifying User:\tS-1-5-80-3088073201-1464728630-1879813800-1107566885-823218052\n\tModifying Application:\tC:\\WINDOWS\\System32\\svchost.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 09:16:52.933\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\tMicrosoft.Office.ActionsServer_8wekyb3d8bbweS-1-5-21-3712849175-2219398513-4278588552-1006-Out-Block\n\tRule Name:\tMicrosoft.Office.ActionsServer\n\tModifying User:\tS-1-5-80-3088073201-1464728630-1879813800-1107566885-823218052\n\tModifying Application:\tC:\\WINDOWS\\System32\\svchost.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 09:16:52.933\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\tMicrosoft.Office.ActionsServer_8wekyb3d8bbweS-1-5-21-3712849175-2219398513-4278588552-1006-In-Block\n\tRule Name:\tMicrosoft.Office.ActionsServer\n\tModifying User:\tS-1-5-80-3088073201-1464728630-1879813800-1107566885-823218052\n\tModifying Application:\tC:\\WINDOWS\\System32\\svchost.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 09:16:52.934\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\tMicrosoft.Office.ActionsServer_8wekyb3d8bbweS-1-5-21-3712849175-2219398513-4278588552-1006-Out-Allow-AllCapabilities\n\tRule Name:\tMicrosoft.Office.ActionsServer\n\tModifying User:\tS-1-5-80-3088073201-1464728630-1879813800-1107566885-823218052\n\tModifying Application:\tC:\\WINDOWS\\System32\\svchost.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 09:16:53.032\t1024\tPackage Microsoft.Office.ActionsServer_8wekyb3d8bbwe for user S-1-5-21-3712849175-2219398513-4278588552-1006 successfully deprovisioned\tInformation\tMicrosoft-Windows-Privacy-Auditing/Operational\tMicrosoft-Windows-Privacy-Auditing\n05.09.2026 09:16:53.054\t2415\tAn application was unregistered with the following parameters: Microsoft.Office.ActionsServer_8wekyb3d8bbwe!Microsoft.Office.ActionsServer [AppUserModelId] The operation completed successfully. [ErrorCode]\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:16:53.061\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:53.061\t617\tSuccessfully updated the status for package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe and user S-1-5-21-3712849175-2219398513-4278588552-1006 (Clear=0xFFFFFFFF, Set=0x0).\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:53.066\t41\tSuccessfully deleted AppContainer Microsoft.Office.ActionsServer_8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:16:53.091\t2562\t\tInformation\tApplication\tMicrosoft-Windows-AppXDeploymentServer/Operational\n05.09.2026 09:16:53.131\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:53.134\t818\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1006.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:53.138\t400\tDeployment Remove operation with target volume C: on Package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe from:  (Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:53.141\t472\tMoving package folder \\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe to \\\\?\\C:\\Program Files\\WindowsApps\\Deleted\\Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe21e230d2-de2e-443e-8514-9c932ad21344. Result: 0x0.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:53.152\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:54.669\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:54.672\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:56.928\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:16:56.928\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:16:56.965\t7040\tThe start type of the \u0424\u043e\u043d\u043e\u0432\u0430\u044f \u0438\u043d\u0442\u0435\u043b\u043b\u0435\u043a\u0442\u0443\u0430\u043b\u044c\u043d\u0430\u044f \u0441\u043b\u0443\u0436\u0431\u0430 \u043f\u0435\u0440\u0435\u0434\u0430\u0447\u0438 (BITS) service was changed from \u0412\u0440\u0443\u0447\u043d\u0443\u044e to \u0410\u0432\u0442\u043e\u043c\u0430\u0442\u0438\u0447\u0435\u0441\u043a\u0438.\tInformation\tSystem\tService Control Manager\n05.09.2026 09:16:56.975\t306\tThe BITS service loaded the job list from disk.\tVerbose\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 09:16:56.980\t145\tWSMan operation Enumeration started with resourceUri http://schemas.microsoft.com/wbem/wsman/1/config/listener\tInformation\tMicrosoft-Windows-WinRM/Operational\tMicrosoft-Windows-WinRM\n05.09.2026 09:16:57.771\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:17:00.107\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:17:01.067\t254\tActivity Transfer\tInformation\tMicrosoft-Windows-WinRM/Operational\tMicrosoft-Windows-WinRM\n05.09.2026 09:17:01.067\t161\t\u041a\u043b\u0438\u0435\u043d\u0442\u0443 \u043d\u0435 \u0443\u0434\u0430\u0435\u0442\u0441\u044f \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0438\u0442\u044c\u0441\u044f \u043a \u0443\u0437\u043b\u0443 \u043d\u0430\u0437\u043d\u0430\u0447\u0435\u043d\u0438\u044f, \u0443\u043a\u0430\u0437\u0430\u043d\u043d\u043e\u043c\u0443 \u0432 \u0437\u0430\u043f\u0440\u043e\u0441\u0435. \u0423\u0431\u0435\u0434\u0438\u0442\u0435\u0441\u044c, \u0447\u0442\u043e \u0441\u043b\u0443\u0436\u0431\u0430 \u043d\u0430 \u0443\u0437\u043b\u0435 \u043d\u0430\u0437\u043d\u0430\u0447\u0435\u043d\u0438\u044f \u0440\u0430\u0431\u043e\u0442\u0430\u0435\u0442 \u0438 \u043f\u0440\u0438\u043d\u0438\u043c\u0430\u0435\u0442 \u0437\u0430\u043f\u0440\u043e\u0441\u044b. \u041e\u0437\u043d\u0430\u043a\u043e\u043c\u044c\u0442\u0435\u0441\u044c \u0441 \u0436\u0443\u0440\u043d\u0430\u043b\u0430\u043c\u0438 \u0438 \u0434\u043e\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u0446\u0438\u0435\u0439 \u0434\u043b\u044f \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0435\u043d\u0438\u044f \u0437\u0430\u043f\u0443\u0449\u0435\u043d\u043d\u043e\u0439 \u043d\u0430 \u0443\u0437\u043b\u0435 \u043d\u0430\u0437\u043d\u0430\u0447\u0435\u043d\u0438\u044f \u0441\u043b\u0443\u0436\u0431\u044b WS-Management (\u0447\u0430\u0449\u0435 \u0432\u0441\u0435\u0433\u043e \u044d\u0442\u043e IIS \u0438\u043b\u0438 WinRM). \u0415\u0441\u043b\u0438 \u044d\u0442\u043e \u0441\u043b\u0443\u0436\u0431\u0430 WinRM, \u0442\u043e \u0434\u043b\u044f \u0430\u043d\u0430\u043b\u0438\u0437\u0430 \u0441\u043e\u0441\u0442\u043e\u044f\u043d\u0438\u044f \u0438 \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0438 \u044d\u0442\u043e\u0439 \u0441\u043b\u0443\u0436\u0431\u044b \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0439\u0442\u0435 \u043d\u0430 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u043c \u0443\u0437\u043b\u0435 \u043a\u043e\u043c\u0430\u043d\u0434\u0443 \"winrm quickconfig\".\tError\tMicrosoft-Windows-WinRM/Operational\tMicrosoft-Windows-WinRM\n05.09.2026 09:17:01.067\t142\tWSMan operation Enumeration failed, error code 2150858770\tError\tMicrosoft-Windows-WinRM/Operational\tMicrosoft-Windows-WinRM\n05.09.2026 09:17:01.102\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-544\n\tGroup Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u044b\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x379c\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:17:01.103\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-551\n\tGroup Name:\t\t\u041e\u043f\u0435\u0440\u0430\u0442\u043e\u0440\u044b \u0430\u0440\u0445\u0438\u0432\u0430\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x379c\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:17:01.259\t3\t\"The BITS service created a new job.\nTransfer job: Microsoft Office Click-to-Run\nJob ID: {38a663b2-655a-4099-b6b9-05b5586514e3}\nOwner: HONOR-FRG-X\\admin\nProcess Path: C:\\Users\\admin\\AppData\\Local\\Temp\\Setup055E06B0-880E-4FE1-969E-58992B5940F0\\setup.exe\nProcess ID: 19332\"\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 09:17:01.268\t16403\t\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 09:17:01.465\t310\tThe initialization of the peer helper modules failed with the following error:  0x80070032.\tWarning\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 09:17:01.475\t59\tBITS started the Microsoft Office Click-to-Run transfer job that is associated with the http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v64_16.0.20326.20132.cab URL.\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 09:17:01.581\t60\tBITS stopped transferring the Microsoft Office Click-to-Run transfer job that is associated with the http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v64_16.0.20326.20132.cab URL. The status code is 0x0.\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 09:17:01.583\t4\t\"The transfer job is complete.\nUser: HONOR-FRG-X\\admin\nTransfer job: Microsoft Office Click-to-Run\nJob ID: {38a663b2-655a-4099-b6b9-05b5586514e3}\nOwner: HONOR-FRG-X\\admin\nFile count: 1\"\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 09:17:01.586\t3\t\"The BITS service created a new job.\nTransfer job: Microsoft Office Click-to-Run\nJob ID: {6f42b80d-7019-4f62-b47c-c9cc61bf79ee}\nOwner: HONOR-FRG-X\\admin\nProcess Path: C:\\Users\\admin\\AppData\\Local\\Temp\\Setup055E06B0-880E-4FE1-969E-58992B5940F0\\setup.exe\nProcess ID: 19332\"\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 09:17:01.590\t16403\t\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 09:17:01.697\t59\tBITS started the Microsoft Office Click-to-Run transfer job that is associated with the http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v64_16.0.20326.20132.cab URL.\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 09:17:01.856\t60\tBITS stopped transferring the Microsoft Office Click-to-Run transfer job that is associated with the http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v64_16.0.20326.20132.cab URL. The status code is 0x0.\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 09:17:01.858\t4\t\"The transfer job is complete.\nUser: HONOR-FRG-X\\admin\nTransfer job: Microsoft Office Click-to-Run\nJob ID: {6f42b80d-7019-4f62-b47c-c9cc61bf79ee}\nOwner: HONOR-FRG-X\\admin\nFile count: 1\"\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 09:17:02.444\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:17:17.018\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:17:25.037\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:17:26.473\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:17:31.143\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:17:34.478\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:17:36.378\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:17:36.932\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:17:37.822\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:17:38.934\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:17:44.280\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:17:44.834\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:17:45.806\t8001\t\"Skipping license manager: PFN Microsoft.ScreenSketch_11.2602.49.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:17:45.820\t8001\t\"Skipping license manager: PFN Microsoft.ScreenSketch_11.2602.49.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:17:45.821\t219\tPSMFlags for Desktop AppX process %1 with applicationID %2 is %3.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:17:45.855\t210\tCreated Desktop AppX container {245CDFFE-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.ScreenSketch_11.2602.49.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:17:45.855\t211\tAdded process 16932 to Desktop AppX container 245cdffe-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.ScreenSketch_11.2602.49.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:17:45.857\t201\tCreated process 16932 for application Microsoft.ScreenSketch_8wekyb3d8bbwe!App in package Microsoft.ScreenSketch_11.2602.49.0_x64__8wekyb3d8bbwe. [LaunchProcess]\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:17:46.353\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:17:46.358\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"SnippingTool\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:17:51.490\t3055\tSome toast notifications have been cleared - informed session 1.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:17:51.512\t2416\tA local notification was received from Microsoft.ScreenSketch_8wekyb3d8bbwe!App [AppUserModelId] with a 0 [NotificationId] through an application endpoint.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:17:51.518\t2418\tA local notification was submitted to threadpool: Microsoft.ScreenSketch_8wekyb3d8bbwe!App [AppUserModelId] toast [NotificationType] 9403 [NotificationTrackingId] Local [NotificationSource].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:17:51.523\t3052\tToast with notification tracking id 9403 is being delivered to Microsoft.ScreenSketch_8wekyb3d8bbwe!App on session 1.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:17:51.527\t3153\tToast with notification tracking id 9403 is delivered to Microsoft.ScreenSketch_8wekyb3d8bbwe!App on session 1.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:17:51.658\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n", "creation_timestamp": "2026-09-06T08:48:57.341171Z"}