2013-02-11T20:43:19.2135714 Kessel\M true <QueryList><Query Id="0" Path="Microsoft-Windows-WindowsUpdateClient/Operational"><Select Path="Microsoft-Windows-WindowsUpdateClient/Operational">*[System[Provider[@Name='Microsoft-Windows-WindowsUpdateClient'] and EventID=26]]</Select></Query></QueryList> true <QueryList><Query Id="0" Path="Microsoft-Windows-WindowsUpdateClient/Operational"><Select Path="Microsoft-Windows-WindowsUpdateClient/Operational">*[System[Provider[@Name='Microsoft-Windows-WindowsUpdateClient'] and EventID=40]]</Select></Query></QueryList> S-1-5-18 HighestAvailable IgnoreNew true true true false false false false true true false false false PT1H 7 "C:\Program Files\Windows Defender\MpCmdRun.exe" -SignatureUpdate