Watching Windows Update. More fun than a barrel full of monkeys. 
The red dot Events at this point were “New Binary Seen” for four Microsoft executables which are, well, new. Total upon the update completion: 41.
Cheers.
1 Like
Interesting, I wonder what this “audio device graph isolation” thing is? I have not seen that before on my PC. Perhaps it’s something new.
I hope the update went well and thanks for posting!
I went through the SpyShelter log file for yesterday and that’s:
Allowing process launch request 58: C:\Windows\System32\audiodg.exe by the rule
Along with these which are just the tip of the iceberg:
Allowing process launch request 44: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxTsr.exe by the rule
Allowing process launch request 81: C:\Windows\System32\Speech_OneCore\common\SpeechModelDownload.exe by the rule
Created the 3DC1 UI helper for DESKTOP-AV8S7U1\WIN10
The log file is 411 lines long, but since I didn’t note the times I started the update and when it ended (with that restart in between), I can’t tell precisely which segment of the timeline in the 5½ hours the computer was up related directly to the update.
My purpose was to capture actions during an intensive series of activities and Update fit the bill as the Activity screen is usually laid-back. I didn’t actually sit there for the entire duration of the update.
Analyzing the mysteries and enigmas of Update under the hood is otherwise an exercise in futility to anyone other than those with high level pay grades. My barrel full of monkeys reference is a tongue in cheek descriptive of the exercise.
So, next Update, grab some popcorn, pull up a chair and join in the fun.
However, note that “Launched by TiWorker.exe” is the one launched-by parse that I observed; not an issue, but interesting nonetheless.
Cheers.
1 Like
I think I just got the update you received this morning on my work PC. 