Message	Id	Level	Keywords	RecordId	ProviderName	ProviderId	LogName	ProcessId	ThreadId	MachineName	UserId	TimeCreated	ActivityId	ContainerLog	MatchedQueryIds	Bookmark	LevelDisplayName	OpcodeDisplayName	KeywordsDisplayNames	Properties
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3392; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll	5857	0	4611686018427387904	854	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	3392	2416	hv-cinder-76377	S-1-5-20	9/15/2021 6:31:52 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3392; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll	5857	0	4611686018427387904	853	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	3392	2416	hv-cinder-76377	S-1-5-20	9/15/2021 6:30:49 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3392; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll	5857	0	4611686018427387904	852	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	3392	2416	hv-cinder-76377	S-1-5-20	9/15/2021 6:29:48 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4156; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll	5857	0	4611686018427387904	851	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	4156	1168	hv-cinder-76377	S-1-5-18	9/15/2021 6:28:05 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3392; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll	5857	0	4611686018427387904	850	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	3392	4940	hv-cinder-76377	S-1-5-20	9/15/2021 6:28:04 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {7F4A436F-CED4-4683-9CE2-BE3C4D0B8E4B}; ClientMachine = HV-CINDER-76377; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4492; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1046076658; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	849	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	588	796	hv-cinder-76377	S-1-5-18	9/15/2021 6:27:42 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {866C42F8-343E-45DF-AAEF-4E85E9606983}; ClientMachine = HV-CINDER-76377; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4492; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Host.HostName="iqn.2010-10.org.openstack:volume-42c3b334-dc91-4092-87e0-ad7eedb1f643"; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	848	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	588	3012	hv-cinder-76377	S-1-5-18	9/15/2021 6:27:40 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {8DBA83F0-775F-4585-8DA7-EA5937DF062F}; ClientMachine = HV-CINDER-76377; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4492; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_IDMethod.HostName="iqn.2010-10.org.openstack:volume-42c3b334-dc91-4092-87e0-ad7eedb1f643",Method=4,Value="iqn.1991-05.com.microsoft:hv-cinder-76377"; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	847	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	588	3012	hv-cinder-76377	S-1-5-18	9/15/2021 6:27:40 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {05C19AFE-6DA6-4802-B9CF-4CE4177C3474}; ClientMachine = HV-CINDER-76377; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4492; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{0B3ACB35-607C-44DC-8AFC-9B24373E85D4}"; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	846	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	588	796	hv-cinder-76377	S-1-5-18	9/15/2021 6:27:36 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {A4961D2D-AA9F-49A4-A760-77EE014939CE}; ClientMachine = HV-CINDER-76377; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4492; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1680252321; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	845	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	588	796	hv-cinder-76377	S-1-5-18	9/15/2021 6:27:35 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {3C569D60-609B-4E88-A9A3-1D796DDBC7F3}; ClientMachine = HV-CINDER-76377; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4492; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Host.HostName="iqn.2010-10.org.openstack:volume-bad87b94-eb0b-43b6-bc71-33713b25c6f1"; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	844	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	588	772	hv-cinder-76377	S-1-5-18	9/15/2021 6:27:34 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {72A7E8D4-E2BF-4E6F-ADB3-E21E1B0F821D}; ClientMachine = HV-CINDER-76377; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4492; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_IDMethod.HostName="iqn.2010-10.org.openstack:volume-bad87b94-eb0b-43b6-bc71-33713b25c6f1",Method=4,Value="iqn.1991-05.com.microsoft:hv-cinder-76377"; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	843	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	588	772	hv-cinder-76377	S-1-5-18	9/15/2021 6:27:34 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WinTargetProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1960; ProviderPath = C:\windows\system32\wbem\WTWMIProv.dll	5857	0	4611686018427387904	842	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	1960	536	hv-cinder-76377	S-1-5-19	9/15/2021 6:27:34 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
StorageWMI provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3392; ProviderPath = %SystemRoot%\System32\storagewmi.dll	5857	0	4611686018427387904	841	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	3392	4940	hv-cinder-76377	S-1-5-20	9/15/2021 6:27:33 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
StorageWMI provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3392; ProviderPath = %SystemRoot%\System32\storagewmi.dll	5857	0	4611686018427387904	840	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	3392	4940	hv-cinder-76377	S-1-5-20	9/15/2021 6:25:49 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
MSVSS__PROVIDER provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3392; ProviderPath = %systemroot%\system32\wbem\vsswmi.dll	5857	0	4611686018427387904	839	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	3392	4940	hv-cinder-76377	S-1-5-20	9/15/2021 6:25:45 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {6111EC04-7B4C-4A19-88D2-C3475FFC77AA}; ClientMachine = HV-CINDER-76377; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4492; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=432636848; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	838	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	588	796	hv-cinder-76377	S-1-5-18	9/15/2021 6:25:45 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WinTargetProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 376; ProviderPath = C:\windows\system32\wbem\WTWMIProv.dll	5857	0	4611686018427387904	837	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	376	4052	hv-cinder-76377	S-1-5-19	9/15/2021 6:25:38 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {4AFB6F94-C7A9-417A-B013-58470E0E1E1F}; ClientMachine = HV-CINDER-76377; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4492; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Host.HostName="iqn.2010-10.org.openstack:volume-42c3b334-dc91-4092-87e0-ad7eedb1f643"; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	836	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	588	772	hv-cinder-76377	S-1-5-18	9/15/2021 6:23:53 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {94A99E4D-FD3E-4D20-AD44-27A58C0A013A}; ClientMachine = HV-CINDER-76377; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4492; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_IDMethod.HostName="iqn.2010-10.org.openstack:volume-42c3b334-dc91-4092-87e0-ad7eedb1f643",Method=4,Value="iqn.1991-05.com.microsoft:hv-cinder-76377"; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	835	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	588	3760	hv-cinder-76377	S-1-5-18	9/15/2021 6:23:53 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WinTargetProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2808; ProviderPath = C:\windows\system32\wbem\WTWMIProv.dll	5857	0	4611686018427387904	834	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2808	4756	hv-cinder-76377	S-1-5-19	9/15/2021 6:23:53 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
StorageWMI provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3392; ProviderPath = %SystemRoot%\System32\storagewmi.dll	5857	0	4611686018427387904	833	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	3392	4940	hv-cinder-76377	S-1-5-20	9/15/2021 6:23:52 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {2BDCD0FA-6360-451B-A350-A003533AFA96}; ClientMachine = HV-CINDER-76377; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4492; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1214342083; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	832	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	588	772	hv-cinder-76377	S-1-5-18	9/15/2021 6:22:11 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {2248AB53-873C-4CE0-8E81-AB116B8BED37}; ClientMachine = HV-CINDER-76377; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4848; Component = Unknown; Operation = Start IWbemServices::GetObject - root\virtualization\v2 : \\.\ROOT\virtualization\v2:Msvm_VirtualSystemSettingData.InstanceID="Microsoft:B8CAE8E1-7A5E-426A-A9F1-504D673B3C68"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	831	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	588	2080	hv-cinder-76377	S-1-5-18	9/15/2021 6:22:08 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {3F5D6293-7369-486F-A342-2A086DA9A3A4}; ClientMachine = HV-CINDER-76377; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4492; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=575671696; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	830	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	588	576	hv-cinder-76377	S-1-5-18	9/15/2021 6:21:52 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {E453A135-FFF0-46EF-8D0A-E5952B02910D}; ClientMachine = HV-CINDER-76377; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4492; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1688827940; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	829	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	588	3760	hv-cinder-76377	S-1-5-18	9/15/2021 6:21:45 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {D5EA7385-CFF5-4A75-A186-1A1B4C7F17AE}; ClientMachine = HV-CINDER-76377; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4492; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1801843042; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	828	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	588	3760	hv-cinder-76377	S-1-5-18	9/15/2021 6:21:44 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {2A2746CA-2F1F-4B59-A445-8C8767E638F8}; ClientMachine = HV-CINDER-76377; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4492; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=361323253; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	827	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	588	3012	hv-cinder-76377	S-1-5-18	9/15/2021 6:21:43 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {BD43720C-BE14-4DD6-83E1-426077E71111}; ClientMachine = HV-CINDER-76377; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4492; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=841486596; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	826	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	588	3012	hv-cinder-76377	S-1-5-18	9/15/2021 6:21:43 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {596620E0-CA7B-4520-8F07-5D6771990C5B}; ClientMachine = HV-CINDER-76377; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4492; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=910673206; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	825	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	588	576	hv-cinder-76377	S-1-5-18	9/15/2021 6:21:40 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {0BC73BA6-8122-404A-A39D-48BA0B464E06}; ClientMachine = HV-CINDER-76377; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4492; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1340212077; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	824	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	588	3012	hv-cinder-76377	S-1-5-18	9/15/2021 6:21:40 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {EF9BDEDC-6161-47DC-907F-458DC3BAAFE5}; ClientMachine = HV-CINDER-76377; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4492; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Host.HostName="iqn.2010-10.org.openstack:volume-efef1341-2d8b-4b3c-80ad-9c75ee0bcaa8"; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	823	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	588	2080	hv-cinder-76377	S-1-5-18	9/15/2021 6:21:40 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {56520179-A3FC-4E59-B727-8CD8632AB3B2}; ClientMachine = HV-CINDER-76377; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4492; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_IDMethod.HostName="iqn.2010-10.org.openstack:volume-efef1341-2d8b-4b3c-80ad-9c75ee0bcaa8",Method=4,Value="iqn.1991-05.com.microsoft:hv-cinder-76377"; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	822	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	588	576	hv-cinder-76377	S-1-5-18	9/15/2021 6:21:39 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {39C209E7-A9DB-42B0-AFA1-CDA4184E7799}; ClientMachine = HV-CINDER-76377; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4848; Component = Unknown; Operation = Start IWbemServices::GetObject - root\virtualization\v2 : \\.\ROOT\virtualization\v2:Msvm_VirtualSystemSettingData.InstanceID="Microsoft:D57198F6-DBF8-416C-BAC0-C39843B05F4D"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	821	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	588	3760	hv-cinder-76377	S-1-5-18	9/15/2021 6:21:34 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {DFA041FB-87E5-4DED-BBE9-EFD31218083F}; ClientMachine = HV-CINDER-76377; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4492; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=889470496; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	820	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	588	2104	hv-cinder-76377	S-1-5-18	9/15/2021 6:21:33 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {EE8E5046-85F5-43E9-8915-FD5FDE98BD18}; ClientMachine = HV-CINDER-76377; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4492; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1155135915; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	819	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	588	3760	hv-cinder-76377	S-1-5-18	9/15/2021 6:21:31 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {06CD4585-DF2D-46C8-BA58-AD9853C40882}; ClientMachine = HV-CINDER-76377; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4492; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1430181977; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	818	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	588	3760	hv-cinder-76377	S-1-5-18	9/15/2021 6:21:26 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {66FECB8B-A868-4E80-A6C3-850566E838CB}; ClientMachine = HV-CINDER-76377; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4492; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=353753629; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	817	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	588	772	hv-cinder-76377	S-1-5-18	9/15/2021 6:21:26 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {6FCCC093-C804-4C14-AB06-F2FB8D39C28D}; ClientMachine = HV-CINDER-76377; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4492; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Host.HostName="iqn.2010-10.org.openstack:volume-c89bbebf-5023-4620-bff7-072f8f90ffb8"; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	816	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	588	772	hv-cinder-76377	S-1-5-18	9/15/2021 6:21:26 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {2EAD51FB-5241-4C3E-87DD-348781CCA031}; ClientMachine = HV-CINDER-76377; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4492; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_IDMethod.HostName="iqn.2010-10.org.openstack:volume-c89bbebf-5023-4620-bff7-072f8f90ffb8",Method=4,Value="iqn.1991-05.com.microsoft:hv-cinder-76377"; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	815	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	588	3760	hv-cinder-76377	S-1-5-18	9/15/2021 6:21:26 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {6B9176A2-8DE2-4860-9C67-87039B5807CF}; ClientMachine = HV-CINDER-76377; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4492; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{1DD01345-4B57-4951-A26F-656303C41B55}"; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	814	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	588	772	hv-cinder-76377	S-1-5-18	9/15/2021 6:21:25 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {313EDC7B-AE8E-4E90-ADDE-C78C02D07108}; ClientMachine = HV-CINDER-76377; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4492; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{61563857-3609-4445-BD0A-907EEA621866}"; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	813	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	588	772	hv-cinder-76377	S-1-5-18	9/15/2021 6:21:24 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {D70F708A-A255-4EAD-A999-D7A260E2C730}; ClientMachine = HV-CINDER-76377; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4492; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{1B83E32E-3689-47D2-9088-496F34AAB7B3}"; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	812	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	588	2104	hv-cinder-76377	S-1-5-18	9/15/2021 6:21:18 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {DD2E712D-D775-4BE7-AF57-E13634945D34}; ClientMachine = HV-CINDER-76377; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4492; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{C5418A75-6190-4BB8-BF57-CF4F0B41C8E2}"; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	811	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	588	2104	hv-cinder-76377	S-1-5-18	9/15/2021 6:21:12 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {68D7D34D-0B8A-4C6A-AD8E-B28F86E12C70}; ClientMachine = HV-CINDER-76377; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4492; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{5240E50A-D6EF-4C6B-B2E9-6F91005516F0}"; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	810	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	588	4852	hv-cinder-76377	S-1-5-18	9/15/2021 6:21:07 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9C9E0811-649D-4851-9A62-55B790DA5B3D}; ClientMachine = HV-CINDER-76377; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4492; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Host.HostName="iqn.2010-10.org.openstack:volume-f14d5103-f0d6-4505-90cf-bf9f5c06734e"; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	809	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	588	772	hv-cinder-76377	S-1-5-18	9/15/2021 6:20:53 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {8D817ADB-D4CC-422A-8C15-DDBFF46DDD40}; ClientMachine = HV-CINDER-76377; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4492; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_IDMethod.HostName="iqn.2010-10.org.openstack:volume-f14d5103-f0d6-4505-90cf-bf9f5c06734e",Method=4,Value="iqn.1991-05.com.microsoft:hv-cinder-76377"; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	808	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	588	772	hv-cinder-76377	S-1-5-18	9/15/2021 6:20:53 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {6DB508FF-7D0A-4EEB-9A8A-FFF133BDA4B1}; ClientMachine = HV-CINDER-76377; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4492; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1758482553; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	807	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	588	772	hv-cinder-76377	S-1-5-18	9/15/2021 6:20:53 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {CE356CAF-0E8B-4052-85E4-140AF60CF765}; ClientMachine = HV-CINDER-76377; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4492; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Host.HostName="iqn.2010-10.org.openstack:volume-727bbf0b-63b3-4ef8-9bb9-d46d5441bd2b"; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	806	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	588	3760	hv-cinder-76377	S-1-5-18	9/15/2021 6:20:52 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {AC427E9D-9582-4077-90CD-AA381C71A344}; ClientMachine = HV-CINDER-76377; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4492; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_IDMethod.HostName="iqn.2010-10.org.openstack:volume-727bbf0b-63b3-4ef8-9bb9-d46d5441bd2b",Method=4,Value="iqn.1991-05.com.microsoft:hv-cinder-76377"; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	805	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	588	3012	hv-cinder-76377	S-1-5-18	9/15/2021 6:20:52 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {AE314553-4B97-4D60-B5EE-5349826BEA73}; ClientMachine = HV-CINDER-76377; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4492; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=41464805; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	804	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	588	3760	hv-cinder-76377	S-1-5-18	9/15/2021 6:20:49 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {B0C777FF-C77C-4A84-A748-511274F8AFAF}; ClientMachine = HV-CINDER-76377; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4492; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1195614066; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	803	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	588	3012	hv-cinder-76377	S-1-5-18	9/15/2021 6:20:49 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {4A699970-3A0A-41E6-80A5-330124E79F1E}; ClientMachine = HV-CINDER-76377; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4492; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=188122377; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	802	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	588	3012	hv-cinder-76377	S-1-5-18	9/15/2021 6:20:39 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {A07E5409-212B-423D-A40C-F58A73510DBC}; ClientMachine = HV-CINDER-76377; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4492; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Host.HostName="iqn.2010-10.org.openstack:volume-d9ef6e7b-5d2e-4104-8130-df2731b208e6"; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	801	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	588	796	hv-cinder-76377	S-1-5-18	9/15/2021 6:20:31 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {D6C53E6B-38FF-449A-BD86-22CD1A05EF8C}; ClientMachine = HV-CINDER-76377; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4492; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_IDMethod.HostName="iqn.2010-10.org.openstack:volume-d9ef6e7b-5d2e-4104-8130-df2731b208e6",Method=4,Value="iqn.1991-05.com.microsoft:hv-cinder-76377"; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	800	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	588	796	hv-cinder-76377	S-1-5-18	9/15/2021 6:20:31 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {B73E3001-E3D5-49AC-9B5F-E515A6F74319}; ClientMachine = HV-CINDER-76377; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4492; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1535618093; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	799	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	588	3760	hv-cinder-76377	S-1-5-18	9/15/2021 6:20:22 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {27CBB545-E216-4C95-AE94-9D180DC72AF8}; ClientMachine = HV-CINDER-76377; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4492; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=104304643; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	798	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	588	3760	hv-cinder-76377	S-1-5-18	9/15/2021 6:20:21 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {98CE0563-188A-4E40-9E17-B35D34F7A57A}; ClientMachine = HV-CINDER-76377; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4492; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Host.HostName="iqn.2010-10.org.openstack:volume-efef1341-2d8b-4b3c-80ad-9c75ee0bcaa8"; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	797	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	588	3012	hv-cinder-76377	S-1-5-18	9/15/2021 6:19:54 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {AE9901D6-C127-4260-98A7-43124707654B}; ClientMachine = HV-CINDER-76377; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4492; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_IDMethod.HostName="iqn.2010-10.org.openstack:volume-efef1341-2d8b-4b3c-80ad-9c75ee0bcaa8",Method=4,Value="iqn.1991-05.com.microsoft:hv-cinder-76377"; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	796	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	588	3012	hv-cinder-76377	S-1-5-18	9/15/2021 6:19:54 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {EE31456C-0E3A-4987-9C6A-B141CB0D1A69}; ClientMachine = HV-CINDER-76377; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4492; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1844643503; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	795	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	588	84	hv-cinder-76377	S-1-5-18	9/15/2021 6:19:53 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {56A1CF09-C0D3-41F7-9A30-62552E5AED9E}; ClientMachine = HV-CINDER-76377; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4492; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=851154310; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	794	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	588	84	hv-cinder-76377	S-1-5-18	9/15/2021 6:19:52 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {8822B731-FC99-4691-9EF4-48FC479842AC}; ClientMachine = HV-CINDER-76377; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4492; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=362691919; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	793	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	588	3012	hv-cinder-76377	S-1-5-18	9/15/2021 6:19:51 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {0F51DEB5-D5D2-4CFF-8428-45AC11BD6A13}; ClientMachine = HV-CINDER-76377; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4492; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Host.HostName="iqn.2010-10.org.openstack:volume-99fde77b-fcb6-4cca-a6cd-8fbf791e0f9c"; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	792	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	588	84	hv-cinder-76377	S-1-5-18	9/15/2021 6:19:46 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9E38378C-3514-4FDE-8602-9884D5F47382}; ClientMachine = HV-CINDER-76377; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4492; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_IDMethod.HostName="iqn.2010-10.org.openstack:volume-99fde77b-fcb6-4cca-a6cd-8fbf791e0f9c",Method=4,Value="iqn.1991-05.com.microsoft:hv-cinder-76377"; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	791	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	588	84	hv-cinder-76377	S-1-5-18	9/15/2021 6:19:45 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {30CB7D11-50A5-45AC-B6C2-87C613819DEA}; ClientMachine = HV-CINDER-76377; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4492; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Host.HostName="iqn.2010-10.org.openstack:volume-4fc40fc2-1409-4ec1-9cbe-b7a0edd247f2"; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	790	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	588	84	hv-cinder-76377	S-1-5-18	9/15/2021 6:19:45 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {CC3714ED-90B9-4A98-B3FC-C7D110D91A5C}; ClientMachine = HV-CINDER-76377; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4492; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_IDMethod.HostName="iqn.2010-10.org.openstack:volume-4fc40fc2-1409-4ec1-9cbe-b7a0edd247f2",Method=4,Value="iqn.1991-05.com.microsoft:hv-cinder-76377"; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	789	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	588	2104	hv-cinder-76377	S-1-5-18	9/15/2021 6:19:45 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
StorageWMI provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3392; ProviderPath = %SystemRoot%\System32\storagewmi.dll	5857	0	4611686018427387904	788	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	3392	2416	hv-cinder-76377	S-1-5-20	9/15/2021 6:19:13 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {C7B18C66-5C6C-432D-BBDE-23936EB7B4F5}; ClientMachine = HV-CINDER-76377; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4492; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1119465855; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	787	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	588	1308	hv-cinder-76377	S-1-5-18	9/15/2021 6:18:31 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {BF52DCD3-6297-4111-981C-FD587B30E7D8}; ClientMachine = HV-CINDER-76377; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4492; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=353183923; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	786	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	588	1308	hv-cinder-76377	S-1-5-18	9/15/2021 6:18:30 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {A950F7E6-8F14-4F2E-A3F1-6CEBD7F54BAE}; ClientMachine = HV-CINDER-76377; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4492; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=743597436; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	785	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	588	2104	hv-cinder-76377	S-1-5-18	9/15/2021 6:18:29 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {2B5E8FDE-5564-4064-9214-FFAFEB719075}; ClientMachine = HV-CINDER-76377; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4492; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{273EC113-7767-47FD-B1F8-3744B091A8A3}"; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	784	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	588	2104	hv-cinder-76377	S-1-5-18	9/15/2021 6:18:27 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {258DFFEF-7B4B-4A43-9EA6-1E5CA04B52C0}; ClientMachine = HV-CINDER-76377; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4492; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=775831809; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	783	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	588	1308	hv-cinder-76377	S-1-5-18	9/15/2021 6:18:26 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {13688FD2-1BD5-4FA2-90DF-EF89684F1C4A}; ClientMachine = HV-CINDER-76377; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4492; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{5AFBA0DD-83E4-460C-BFC4-EF05D107DD8F}"; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	782	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	588	772	hv-cinder-76377	S-1-5-18	9/15/2021 6:18:25 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {75749F29-9400-40C6-A231-64844920235D}; ClientMachine = HV-CINDER-76377; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4492; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1816767918; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	781	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	588	2080	hv-cinder-76377	S-1-5-18	9/15/2021 6:18:24 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {29D43761-49C9-4377-88DD-41CBD3E588DB}; ClientMachine = HV-CINDER-76377; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4492; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=500714412; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	780	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	588	2104	hv-cinder-76377	S-1-5-18	9/15/2021 6:18:24 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {EA45740E-D9A3-4269-B8D9-3EC4BEF32598}; ClientMachine = HV-CINDER-76377; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4492; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=2125444353; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	779	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	588	576	hv-cinder-76377	S-1-5-18	9/15/2021 6:18:23 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {B8EB17D6-151E-43E6-B320-99C5BD95DD82}; ClientMachine = HV-CINDER-76377; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4492; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{0E90336F-33FC-4272-A2C2-D41BAA0F4919}"; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	778	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	588	2104	hv-cinder-76377	S-1-5-18	9/15/2021 6:18:23 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {37EE57A3-6A95-422E-B844-7E540621272A}; ClientMachine = HV-CINDER-76377; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4492; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{596D6D07-7248-41F0-9CDB-F7FBF13FC64F}"; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	777	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	588	2080	hv-cinder-76377	S-1-5-18	9/15/2021 6:18:22 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {18166A80-8D0F-45A6-B39E-26721170E6DF}; ClientMachine = HV-CINDER-76377; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4492; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{E64CF370-08C5-4003-A305-CF3E9A0395D5}"; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	776	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	588	772	hv-cinder-76377	S-1-5-18	9/15/2021 6:18:18 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96A96679-554C-47DC-A859-9214529623FB}; ClientMachine = HV-CINDER-76377; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4492; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1007966943; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	775	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	588	2104	hv-cinder-76377	S-1-5-18	9/15/2021 6:18:17 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {D9E52F34-BB0E-496A-BD70-39884C772B68}; ClientMachine = HV-CINDER-76377; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4492; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=742332711; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	774	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	588	2104	hv-cinder-76377	S-1-5-18	9/15/2021 6:18:13 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {7161B85F-7035-4F8C-A92C-75A9F1BDAC3A}; ClientMachine = HV-CINDER-76377; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4492; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Host.HostName="iqn.2010-10.org.openstack:volume-84c8b2dc-8558-4e63-b883-ec90af1d5c3b"; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	773	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	588	1728	hv-cinder-76377	S-1-5-18	9/15/2021 6:17:59 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {66E33E3D-A51B-41F0-8322-48AD005A9206}; ClientMachine = HV-CINDER-76377; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4492; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_IDMethod.HostName="iqn.2010-10.org.openstack:volume-84c8b2dc-8558-4e63-b883-ec90af1d5c3b",Method=4,Value="iqn.1991-05.com.microsoft:hv-cinder-76377"; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	772	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	588	1728	hv-cinder-76377	S-1-5-18	9/15/2021 6:17:58 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {A12B89B4-EEDA-43B8-8E84-99EA08C600E2}; ClientMachine = HV-CINDER-76377; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4492; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=340567239; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	771	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	588	2104	hv-cinder-76377	S-1-5-18	9/15/2021 6:17:58 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {6A04D960-5DD6-4891-A017-0583FDDA86AB}; ClientMachine = HV-CINDER-76377; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4492; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{4525259A-04A6-4620-AF0A-358B4333E024}"; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	770	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	588	3012	hv-cinder-76377	S-1-5-18	9/15/2021 6:17:57 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {ECFEAE37-6548-4A53-8C5B-FF71F6A5FFB8}; ClientMachine = HV-CINDER-76377; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4492; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{35ECB102-285F-4610-A802-3F185591EAA9}"; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	769	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	588	576	hv-cinder-76377	S-1-5-18	9/15/2021 6:17:56 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {26B0F612-DB8B-4ADA-9399-46C4A8B3DA00}; ClientMachine = HV-CINDER-76377; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4492; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{6B687A68-3890-4F62-B2C1-A9F5DAA9E5DD}"; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	768	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	588	3252	hv-cinder-76377	S-1-5-18	9/15/2021 6:17:55 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {E1596DB2-0B4C-4EED-92B1-9A18D9C7B18B}; ClientMachine = HV-CINDER-76377; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4492; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{FEE58608-86E1-433F-AB94-7E0C9519D035}"; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	767	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	588	3252	hv-cinder-76377	S-1-5-18	9/15/2021 6:17:55 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {11776B94-5875-47E7-A49C-DDC2EEFDCC48}; ClientMachine = HV-CINDER-76377; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4848; Component = Unknown; Operation = Start IWbemServices::GetObject - root\virtualization\v2 : \\.\ROOT\virtualization\v2:Msvm_VirtualSystemSettingData.InstanceID="Microsoft:A3B81ADE-0583-4AAA-B485-067B4BEF880F"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	766	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	588	3252	hv-cinder-76377	S-1-5-18	9/15/2021 6:17:47 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {B7D4F062-FB0D-46C0-9B0A-D8A5AA4881E0}; ClientMachine = HV-CINDER-76377; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4492; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Host.HostName="iqn.2010-10.org.openstack:volume-b8da95b4-fddf-460c-ae4a-dc4f24139c7b"; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	765	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	588	1896	hv-cinder-76377	S-1-5-18	9/15/2021 6:17:43 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {846B0C6F-3C40-4041-8121-4632BD5F1326}; ClientMachine = HV-CINDER-76377; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4492; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_IDMethod.HostName="iqn.2010-10.org.openstack:volume-b8da95b4-fddf-460c-ae4a-dc4f24139c7b",Method=4,Value="iqn.1991-05.com.microsoft:hv-cinder-76377"; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	764	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	588	1896	hv-cinder-76377	S-1-5-18	9/15/2021 6:17:43 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {5524F6FC-3E9F-4D18-B564-F57CA61BFA74}; ClientMachine = HV-CINDER-76377; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4492; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1490866892; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	763	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	588	1308	hv-cinder-76377	S-1-5-18	9/15/2021 6:17:41 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {19F59EA8-A602-49E4-8E28-E38109ED5CB9}; ClientMachine = HV-CINDER-76377; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4492; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=489484691; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	762	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	588	796	hv-cinder-76377	S-1-5-18	9/15/2021 6:17:34 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {361717C2-D2A4-4233-B92E-28963F6BE619}; ClientMachine = HV-CINDER-76377; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4492; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=469135400; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	761	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	588	796	hv-cinder-76377	S-1-5-18	9/15/2021 6:17:34 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {D61CAB4C-75B0-4080-BDA3-75CF56207A6A}; ClientMachine = HV-CINDER-76377; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4492; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=443135282; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	760	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	588	84	hv-cinder-76377	S-1-5-18	9/15/2021 6:17:33 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {B2FCAB79-B2A6-47D3-870B-F517F7C0A9CA}; ClientMachine = HV-CINDER-76377; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4492; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{B4BEAF1B-0015-420B-8E75-8A1B29B1588F}"; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	759	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	588	796	hv-cinder-76377	S-1-5-18	9/15/2021 6:17:32 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {5B13CB0F-E5A0-4545-94BC-C8BAEC353B60}; ClientMachine = HV-CINDER-76377; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4492; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=849167096; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	758	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	588	84	hv-cinder-76377	S-1-5-18	9/15/2021 6:17:32 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {CEF4B1F1-5EF4-419D-81EC-7F6B179C69E1}; ClientMachine = HV-CINDER-76377; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4492; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1176881834; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	757	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	588	3012	hv-cinder-76377	S-1-5-18	9/15/2021 6:17:17 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {0AEFBB8C-6F63-4D09-B093-EB975515E99D}; ClientMachine = HV-CINDER-76377; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4492; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{68B18877-9F97-4EFA-BB0F-B9193BD64035}"; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	756	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	588	3252	hv-cinder-76377	S-1-5-18	9/15/2021 6:17:17 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {3A58C09D-19C0-4E80-9BD2-B23916742724}; ClientMachine = HV-CINDER-76377; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4492; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=287087565; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	755	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	588	3252	hv-cinder-76377	S-1-5-18	9/15/2021 6:17:16 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {29F965DD-2AD1-49EB-A667-48C128392423}; ClientMachine = HV-CINDER-76377; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4492; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=272434782; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	754	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	588	3012	hv-cinder-76377	S-1-5-18	9/15/2021 6:17:12 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {4EA6575D-06D0-4658-9B4E-9463BD8ADEA6}; ClientMachine = HV-CINDER-76377; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4492; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1659990672; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	753	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	588	3012	hv-cinder-76377	S-1-5-18	9/15/2021 6:17:09 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {70FAA60D-F5AA-4A38-BF86-557CDD777126}; ClientMachine = HV-CINDER-76377; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4492; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Host.HostName="iqn.2010-10.org.openstack:volume-643ae682-f6af-4387-abab-231978da01ff"; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	752	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	588	796	hv-cinder-76377	S-1-5-18	9/15/2021 6:17:08 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {A6BC55B0-6667-432E-A04F-1583D7BD10F7}; ClientMachine = HV-CINDER-76377; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4492; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_IDMethod.HostName="iqn.2010-10.org.openstack:volume-643ae682-f6af-4387-abab-231978da01ff",Method=4,Value="iqn.1991-05.com.microsoft:hv-cinder-76377"; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	751	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	588	796	hv-cinder-76377	S-1-5-18	9/15/2021 6:17:08 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {6A27F354-E33C-4FC7-8ED7-EA0506395AF8}; ClientMachine = HV-CINDER-76377; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4492; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=18991454; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	750	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	588	772	hv-cinder-76377	S-1-5-18	9/15/2021 6:17:08 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {4F431D18-B184-45AB-B171-9854C5A2024D}; ClientMachine = HV-CINDER-76377; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4492; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{75600031-F356-4DAF-8154-9ED12FE72911}"; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	749	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	588	796	hv-cinder-76377	S-1-5-18	9/15/2021 6:17:06 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {C6E6B0F8-849B-401F-A944-BD45D1716698}; ClientMachine = HV-CINDER-76377; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4492; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{30419EA3-A73B-4542-A6D6-68EB879E4461}"; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	748	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	588	772	hv-cinder-76377	S-1-5-18	9/15/2021 6:17:05 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {0A7B27B0-D76E-4780-AD1C-9E9C041F618C}; ClientMachine = HV-CINDER-76377; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4492; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{92FD6AD9-0D85-4911-9BBB-9FD4790FD14A}"; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	747	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	588	3252	hv-cinder-76377	S-1-5-18	9/15/2021 6:17:05 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {51536330-7F60-4569-A73C-90587469261D}; ClientMachine = HV-CINDER-76377; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4492; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=842889446; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	746	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	588	772	hv-cinder-76377	S-1-5-18	9/15/2021 6:17:05 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {330AC8E3-EBF3-4A0E-B4FF-AE1049D30E49}; ClientMachine = HV-CINDER-76377; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4492; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{5B799A4A-46E7-4829-B9E4-4CB843436BEE}"; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	745	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	588	796	hv-cinder-76377	S-1-5-18	9/15/2021 6:17:04 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {303B765C-6EA9-4038-B7CD-2FF2E1A5E40A}; ClientMachine = HV-CINDER-76377; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4492; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Host.HostName="iqn.2010-10.org.openstack:volume-6faf3eb5-c955-4322-8e96-fec806e5f7c3"; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	744	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	588	3012	hv-cinder-76377	S-1-5-18	9/15/2021 6:16:57 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {0F2C732F-2292-48F8-A68B-C951EF86EF38}; ClientMachine = HV-CINDER-76377; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4492; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_IDMethod.HostName="iqn.2010-10.org.openstack:volume-6faf3eb5-c955-4322-8e96-fec806e5f7c3",Method=4,Value="iqn.1991-05.com.microsoft:hv-cinder-76377"; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	743	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	588	1896	hv-cinder-76377	S-1-5-18	9/15/2021 6:16:57 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {74F3E911-B6AD-4651-8402-9429E0E243FA}; ClientMachine = HV-CINDER-76377; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4492; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=110634242; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	742	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	588	3252	hv-cinder-76377	S-1-5-18	9/15/2021 6:16:53 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FFD38D38-BB74-4709-8326-744EFBC14DA9}; ClientMachine = HV-CINDER-76377; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4492; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1589826637; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	741	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	588	3012	hv-cinder-76377	S-1-5-18	9/15/2021 6:16:49 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {B7FF1152-893A-4BAF-8D63-F134BE9038AD}; ClientMachine = HV-CINDER-76377; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4492; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=2121751269; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	740	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	588	1896	hv-cinder-76377	S-1-5-18	9/15/2021 6:16:43 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {DD6529B7-A543-476A-A291-C488CA850E86}; ClientMachine = HV-CINDER-76377; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4492; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1530603025; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	739	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	588	4852	hv-cinder-76377	S-1-5-18	9/15/2021 6:16:42 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {76D8DE5E-2A2B-49FA-8AB6-D7673F92B6FF}; ClientMachine = HV-CINDER-76377; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4492; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1457913056; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	738	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	588	1896	hv-cinder-76377	S-1-5-18	9/15/2021 6:16:42 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {BA96B436-B08D-4CB4-88F6-4634B4A8E5CB}; ClientMachine = HV-CINDER-76377; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4492; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=488821630; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	737	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	588	1896	hv-cinder-76377	S-1-5-18	9/15/2021 6:16:41 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {39BD9438-4525-40D6-B90F-DECCE4F8060A}; ClientMachine = HV-CINDER-76377; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4492; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Host.HostName="iqn.2010-10.org.openstack:volume-465ef2e2-05df-4150-9392-470b5a98055d"; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	736	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	588	1896	hv-cinder-76377	S-1-5-18	9/15/2021 6:16:41 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {065B7E38-C09F-4F45-BE68-73151DE333C6}; ClientMachine = HV-CINDER-76377; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4492; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_IDMethod.HostName="iqn.2010-10.org.openstack:volume-465ef2e2-05df-4150-9392-470b5a98055d",Method=4,Value="iqn.1991-05.com.microsoft:hv-cinder-76377"; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	735	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	588	4852	hv-cinder-76377	S-1-5-18	9/15/2021 6:16:41 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {01275288-1B6C-4950-9BE1-5426158FF83C}; ClientMachine = HV-CINDER-76377; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4492; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1593730117; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	734	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	588	1896	hv-cinder-76377	S-1-5-18	9/15/2021 6:16:40 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {EFE9FF34-2489-4353-B866-7492CAFEA006}; ClientMachine = HV-CINDER-76377; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4492; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1632381891; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	733	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	588	3760	hv-cinder-76377	S-1-5-18	9/15/2021 6:16:39 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {91F07CFC-1DD7-4D22-BEDD-2D8F726F99E3}; ClientMachine = HV-CINDER-76377; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4492; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{CFD8A370-3F8F-4A80-BB0A-6A7A2D379ADA}"; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	732	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	588	316	hv-cinder-76377	S-1-5-18	9/15/2021 6:16:38 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {88ED5273-1848-499C-9703-5F09F1C7778C}; ClientMachine = HV-CINDER-76377; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4492; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=958655542; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	731	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	588	316	hv-cinder-76377	S-1-5-18	9/15/2021 6:16:38 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
StorageWMI provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3392; ProviderPath = %SystemRoot%\System32\storagewmi.dll	5857	0	4611686018427387904	730	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	3392	2416	hv-cinder-76377	S-1-5-20	9/15/2021 6:16:33 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {E80906F7-4149-4160-BFAA-5F24612AB290}; ClientMachine = HV-CINDER-76377; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4492; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{61925AD7-AC95-4BAA-AEA2-748CA34E2A1F}"; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	729	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	588	3760	hv-cinder-76377	S-1-5-18	9/15/2021 6:16:30 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {46E5DADF-F1CC-4252-8F81-368A77F70C09}; ClientMachine = HV-CINDER-76377; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4492; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1250511258; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	728	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	588	316	hv-cinder-76377	S-1-5-18	9/15/2021 6:16:30 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {02432148-AF43-4427-ABF1-EA3FC9A7FD3E}; ClientMachine = HV-CINDER-76377; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4492; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=366066823; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	727	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	588	316	hv-cinder-76377	S-1-5-18	9/15/2021 6:15:53 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {6779B0E4-0EE2-4DF3-B00F-A281534FEC07}; ClientMachine = HV-CINDER-76377; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4492; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{50B5291F-EE86-474B-B567-CF040D547154}"; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	726	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	588	3012	hv-cinder-76377	S-1-5-18	9/15/2021 6:15:50 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {F4A91E2D-B1B9-47D9-BAE8-65A757E867B5}; ClientMachine = HV-CINDER-76377; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4492; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1254990478; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	725	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	588	3252	hv-cinder-76377	S-1-5-18	9/15/2021 6:15:30 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {1579BADE-73E6-4020-B4FB-965ED7498964}; ClientMachine = HV-CINDER-76377; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4492; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=80787637; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	724	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	588	1896	hv-cinder-76377	S-1-5-18	9/15/2021 6:15:29 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {E3F94338-A27C-49E2-90AE-2499E4151F0F}; ClientMachine = HV-CINDER-76377; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4492; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=93024214; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	723	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	588	576	hv-cinder-76377	S-1-5-18	9/15/2021 6:15:28 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
StorageWMI provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3392; ProviderPath = %SystemRoot%\System32\storagewmi.dll	5857	0	4611686018427387904	722	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	3392	2416	hv-cinder-76377	S-1-5-20	9/15/2021 6:15:27 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {64E1ED67-6426-4849-A299-497DC2AD3A46}; ClientMachine = HV-CINDER-76377; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4492; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=360862423; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	721	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	588	576	hv-cinder-76377	S-1-5-18	9/15/2021 6:15:27 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {71CC8558-441E-4AC3-93FC-79B3C1ECC646}; ClientMachine = HV-CINDER-76377; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4492; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{7C80E117-458F-445A-8E1E-79FA9E9AEE45}"; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	720	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	588	576	hv-cinder-76377	S-1-5-18	9/15/2021 6:15:26 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {1120988A-F04A-43CF-AEEE-358FA57FF23A}; ClientMachine = HV-CINDER-76377; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4492; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1226210076; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	719	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	588	576	hv-cinder-76377	S-1-5-18	9/15/2021 6:15:25 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {402D2731-E15C-47B8-8725-2EB2C008BC31}; ClientMachine = HV-CINDER-76377; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4848; Component = Unknown; Operation = Start IWbemServices::GetObject - root\virtualization\v2 : \\.\ROOT\virtualization\v2:Msvm_VirtualSystemSettingData.InstanceID="Microsoft:4C1C8738-5DF4-4566-AE19-2E0FAF5A0F4B"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	718	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	588	2104	hv-cinder-76377	S-1-5-18	9/15/2021 6:15:17 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {B0AB4358-593C-48EA-A621-E2957F9E4234}; ClientMachine = HV-CINDER-76377; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4492; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1033002023; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	717	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	588	4852	hv-cinder-76377	S-1-5-18	9/15/2021 6:15:17 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {4B160C69-8943-4CA2-80E3-41BAE3B64699}; ClientMachine = HV-CINDER-76377; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4492; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1617682857; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	716	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	588	1728	hv-cinder-76377	S-1-5-18	9/15/2021 6:15:10 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {B4C0169E-CC5C-49C6-9C99-540269776505}; ClientMachine = HV-CINDER-76377; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4492; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{807E1C5D-9C43-4C56-A0E9-8191D061293C}"; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	715	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	588	2104	hv-cinder-76377	S-1-5-18	9/15/2021 6:15:09 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {65B67604-6644-477D-BB9E-42AD2341565E}; ClientMachine = HV-CINDER-76377; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4492; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1689163240; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	714	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	588	1728	hv-cinder-76377	S-1-5-18	9/15/2021 6:15:01 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {70431416-924C-4458-B2E8-2E01B472C468}; ClientMachine = HV-CINDER-76377; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4492; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1641869002; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	713	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	588	1728	hv-cinder-76377	S-1-5-18	9/15/2021 6:15:00 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {BCA6F107-F2EF-455F-80CE-3419E2B70C76}; ClientMachine = HV-CINDER-76377; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4492; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{D2B615B8-45E9-45D2-AD81-E3A43433F509}"; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	712	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	588	796	hv-cinder-76377	S-1-5-18	9/15/2021 6:14:59 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {62B1BB22-4B6F-4A6F-A2DD-40A296B0440A}; ClientMachine = HV-CINDER-76377; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4492; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=480133223; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	711	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	588	1728	hv-cinder-76377	S-1-5-18	9/15/2021 6:14:58 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {3797592A-B9EE-4D24-A644-97614B62D977}; ClientMachine = HV-CINDER-76377; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4492; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1397303987; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	710	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	588	1896	hv-cinder-76377	S-1-5-18	9/15/2021 6:14:52 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {7FDC08D5-168C-4AFE-990B-4C386ACFC2F6}; ClientMachine = HV-CINDER-76377; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4492; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{92DD84C8-01B8-4249-91E9-EE0792068CF0}"; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	709	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	588	1896	hv-cinder-76377	S-1-5-18	9/15/2021 6:14:51 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {46313A5B-A5F5-45F5-A837-AFD6A50185D4}; ClientMachine = HV-CINDER-76377; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4492; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{74E42E1F-2C55-4F2D-8805-7CDAC028E789}"; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	708	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	588	796	hv-cinder-76377	S-1-5-18	9/15/2021 6:14:51 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {909AA7CA-1FD6-4C10-9F22-8D597E1D8151}; ClientMachine = HV-CINDER-76377; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4492; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1320804184; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	707	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	588	796	hv-cinder-76377	S-1-5-18	9/15/2021 6:14:50 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {7574D539-F246-4083-A1F3-18A4F1B7EB76}; ClientMachine = HV-CINDER-76377; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4492; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=558321947; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	706	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	588	3252	hv-cinder-76377	S-1-5-18	9/15/2021 6:14:46 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {6BB11F02-BA89-4483-B0C2-EF52AA2FAFBA}; ClientMachine = HV-CINDER-76377; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4492; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1444244643; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	705	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	588	1308	hv-cinder-76377	S-1-5-18	9/15/2021 6:14:41 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {0C6E7B3B-C8A9-4A62-A2E1-0E2EB3ED0FC6}; ClientMachine = HV-CINDER-76377; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4848; Component = Unknown; Operation = Start IWbemServices::GetObject - root\virtualization\v2 : \\.\ROOT\virtualization\v2:Msvm_VirtualSystemSettingData.InstanceID="Microsoft:6D95A4BA-B468-45ED-BCEF-E42F463D0CE0"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	704	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	588	796	hv-cinder-76377	S-1-5-18	9/15/2021 6:14:38 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {3752013C-0E63-48A3-A0D2-7C6039A260F2}; ClientMachine = HV-CINDER-76377; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4492; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=344256901; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	703	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	588	4852	hv-cinder-76377	S-1-5-18	9/15/2021 6:14:37 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {47007E27-212D-47A5-A30D-C024B845DCE0}; ClientMachine = HV-CINDER-76377; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4492; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=76676125; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	702	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	588	3760	hv-cinder-76377	S-1-5-18	9/15/2021 6:14:36 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {2F5745A9-A7BA-470D-A13E-581F519D114B}; ClientMachine = HV-CINDER-76377; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4492; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1813951955; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	701	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	588	796	hv-cinder-76377	S-1-5-18	9/15/2021 6:14:28 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {DB0A27E0-053E-4718-A712-B02866CB8B6F}; ClientMachine = HV-CINDER-76377; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4492; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=648703790; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	700	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	588	84	hv-cinder-76377	S-1-5-18	9/15/2021 6:14:27 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {494F7C81-7716-4CF0-A8DF-7056507EB247}; ClientMachine = HV-CINDER-76377; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4492; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1315678761; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	699	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	588	84	hv-cinder-76377	S-1-5-18	9/15/2021 6:14:27 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9341437D-DFB9-447F-B8FE-4692CE624175}; ClientMachine = HV-CINDER-76377; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4492; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Host.HostName="iqn.2010-10.org.openstack:volume-dff42bc7-a007-486f-b6d3-c8742e592d62"; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	698	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	588	1308	hv-cinder-76377	S-1-5-18	9/15/2021 6:14:26 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {08BDA937-239A-4908-AB44-9F44CEBA0BAD}; ClientMachine = HV-CINDER-76377; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4492; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_IDMethod.HostName="iqn.2010-10.org.openstack:volume-dff42bc7-a007-486f-b6d3-c8742e592d62",Method=4,Value="iqn.1991-05.com.microsoft:hv-cinder-76377"; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	697	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	588	3760	hv-cinder-76377	S-1-5-18	9/15/2021 6:14:26 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {A1B34950-6086-44AB-9641-6284CDF2AD88}; ClientMachine = HV-CINDER-76377; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4492; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1892785037; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	696	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	588	2080	hv-cinder-76377	S-1-5-18	9/15/2021 6:14:25 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {64BE669D-6DB7-4122-A8F8-19B51C80525C}; ClientMachine = HV-CINDER-76377; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4492; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1729637140; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	695	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	588	4852	hv-cinder-76377	S-1-5-18	9/15/2021 6:14:24 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {3E41BE6F-6BD1-4BA2-A299-01D7D2C35E9D}; ClientMachine = HV-CINDER-76377; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4492; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=556639153; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	694	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	588	4852	hv-cinder-76377	S-1-5-18	9/15/2021 6:14:24 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {ED06D9BF-771D-46ED-AC26-67952E3474DA}; ClientMachine = HV-CINDER-76377; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4492; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{E1588D2E-2F6F-4C9C-BD5D-4C0A7845BB3A}"; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	693	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	588	1308	hv-cinder-76377	S-1-5-18	9/15/2021 6:14:23 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9430671C-8CA7-4842-9C8B-59DF4CFEB1E0}; ClientMachine = HV-CINDER-76377; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4492; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=369934643; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	692	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	588	84	hv-cinder-76377	S-1-5-18	9/15/2021 6:14:18 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {14AB76E3-C65C-4A45-9679-53089F41E90C}; ClientMachine = HV-CINDER-76377; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4492; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1661481813; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	691	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	588	1728	hv-cinder-76377	S-1-5-18	9/15/2021 6:14:15 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {90CCFBB5-2CE4-4044-B66F-E2F1D38FC269}; ClientMachine = HV-CINDER-76377; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4492; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1124589299; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	690	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	588	1308	hv-cinder-76377	S-1-5-18	9/15/2021 6:14:15 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {AA50CC52-3273-461B-BFC2-EDA42BE5D545}; ClientMachine = HV-CINDER-76377; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4492; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=675812219; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	689	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	588	2104	hv-cinder-76377	S-1-5-18	9/15/2021 6:14:14 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {B20BC045-B5B0-464C-9A77-C6420F2FEDCC}; ClientMachine = HV-CINDER-76377; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4492; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1777776115; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	688	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	588	1308	hv-cinder-76377	S-1-5-18	9/15/2021 6:14:14 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {8E26C94D-5B58-4FD2-BEC6-AA1EB1CCA9BC}; ClientMachine = HV-CINDER-76377; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4492; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=191144041; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	687	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	588	1308	hv-cinder-76377	S-1-5-18	9/15/2021 6:14:13 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {5DDCD6B4-1AAE-4649-92DD-AF07C29408EF}; ClientMachine = HV-CINDER-76377; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4492; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{AD2BB5BB-1FE2-450F-8FD1-FB95C38942DC}"; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	686	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	588	1308	hv-cinder-76377	S-1-5-18	9/15/2021 6:14:13 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {AFCA7FB4-2B61-4260-887E-66A47E006D89}; ClientMachine = HV-CINDER-76377; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4492; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{85B6102A-AFC2-4F64-8301-9AE927F19874}"; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	685	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	588	1308	hv-cinder-76377	S-1-5-18	9/15/2021 6:14:13 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
StorageWMI provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3392; ProviderPath = %SystemRoot%\System32\storagewmi.dll	5857	0	4611686018427387904	684	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	3392	2416	hv-cinder-76377	S-1-5-20	9/15/2021 6:14:13 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {3646CD14-1042-4C0D-862F-D96F34F072BA}; ClientMachine = HV-CINDER-76377; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4492; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=869453124; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	683	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	588	2104	hv-cinder-76377	S-1-5-18	9/15/2021 6:14:12 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {0C762AA9-7EBF-4C41-8198-0BC3D23C295C}; ClientMachine = HV-CINDER-76377; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4492; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=58129728; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	682	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	588	2104	hv-cinder-76377	S-1-5-18	9/15/2021 6:14:01 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {4927AB59-C81D-4D06-8A3F-9C5CDFD9C315}; ClientMachine = HV-CINDER-76377; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4492; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=146368247; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	681	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	588	3012	hv-cinder-76377	S-1-5-18	9/15/2021 6:13:59 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {08E4CC2D-F202-4EBA-9245-44BD03F66474}; ClientMachine = HV-CINDER-76377; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4492; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=516862096; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	680	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	588	3252	hv-cinder-76377	S-1-5-18	9/15/2021 6:13:58 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {102C2476-7A26-4CFC-838F-E3F0D4E3F0FB}; ClientMachine = HV-CINDER-76377; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4492; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{50348206-C384-44B3-BDD1-227B78DAF782}"; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	679	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	588	3252	hv-cinder-76377	S-1-5-18	9/15/2021 6:13:57 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {13FF8B9A-AC83-4FB1-B78B-0FBE09BE8F74}; ClientMachine = HV-CINDER-76377; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4492; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1672061363; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	678	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	588	3252	hv-cinder-76377	S-1-5-18	9/15/2021 6:13:57 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {467A66E4-9044-4C62-B1B2-FE70FC84A1DF}; ClientMachine = HV-CINDER-76377; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4492; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1145690217; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	677	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	588	316	hv-cinder-76377	S-1-5-18	9/15/2021 6:13:57 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {EF9B5AA3-E2F8-45EA-9594-5BC02C63DD02}; ClientMachine = HV-CINDER-76377; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4492; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=644994216; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	676	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	588	3760	hv-cinder-76377	S-1-5-18	9/15/2021 6:13:52 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {C8BD2755-5A17-47FA-821A-117A38EADE89}; ClientMachine = HV-CINDER-76377; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4492; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=587241685; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	675	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	588	3760	hv-cinder-76377	S-1-5-18	9/15/2021 6:13:52 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9234156F-91BF-4730-BBB3-7B933DFC361C}; ClientMachine = HV-CINDER-76377; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4492; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{D12DEF2B-D530-43B2-95CE-73C4F58CD47C}"; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	674	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	588	3760	hv-cinder-76377	S-1-5-18	9/15/2021 6:13:50 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {F3E9EC86-FCE4-430F-A5C7-215FED9AA3AE}; ClientMachine = HV-CINDER-76377; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4492; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1261330308; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	673	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	588	84	hv-cinder-76377	S-1-5-18	9/15/2021 6:13:49 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {1EC7A4A3-9D97-4FF6-B7EF-B31F2861ABD7}; ClientMachine = HV-CINDER-76377; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4492; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1412413937; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	672	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	588	3760	hv-cinder-76377	S-1-5-18	9/15/2021 6:13:47 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {A8238505-C0EA-49BB-8A6A-F816FFDDDBD6}; ClientMachine = HV-CINDER-76377; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4492; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1168574792; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	671	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	588	1728	hv-cinder-76377	S-1-5-18	9/15/2021 6:13:33 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {EA47DAF7-4252-4C9D-ACFE-7AC05144C7F4}; ClientMachine = HV-CINDER-76377; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4492; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{811B28C4-712C-43B3-9D76-4A5B99FC9D4B}"; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	670	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	588	2104	hv-cinder-76377	S-1-5-18	9/15/2021 6:13:31 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {F61BE495-6F93-4C62-BCE9-06576CF5B91F}; ClientMachine = HV-CINDER-76377; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4492; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1205951433; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	669	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	588	2104	hv-cinder-76377	S-1-5-18	9/15/2021 6:13:30 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
MSVSS__PROVIDER provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3392; ProviderPath = %systemroot%\system32\wbem\vsswmi.dll	5857	0	4611686018427387904	668	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	3392	2416	hv-cinder-76377	S-1-5-20	9/15/2021 6:13:26 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32a provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3392; ProviderPath = %systemroot%\system32\wbem\wmipcima.dll	5857	0	4611686018427387904	667	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	3392	2512	hv-cinder-76377	S-1-5-20	9/15/2021 6:13:26 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WinTargetProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1044; ProviderPath = C:\windows\system32\wbem\WTWMIProv.dll	5857	0	4611686018427387904	666	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	1044	740	hv-cinder-76377	S-1-5-19	9/15/2021 6:13:25 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3392; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll	5857	0	4611686018427387904	665	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	3392	2512	hv-cinder-76377	S-1-5-20	9/15/2021 6:13:04 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4340; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll	5857	0	4611686018427387904	664	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	4340	1400	hv-cinder-76377	S-1-5-18	9/15/2021 6:12:02 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3392; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll	5857	0	4611686018427387904	663	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	3392	3808	hv-cinder-76377	S-1-5-20	9/15/2021 6:12:02 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Namespace = root\virtualization\v2; NotificationQuery = SELECT * FROM __InstanceDeletionEvent WITHIN 2 WHERE TargetInstance ISA 'Msvm_SyntheticEthernetPortSettingData' ; UserName = NT AUTHORITY\SYSTEM; ClientProcessID = 4232, ClientMachine = HV-CINDER-76377; PossibleCause = Temporary	5860	0	4611686018427387904	662	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	588	4948	hv-cinder-76377	S-1-5-18	9/15/2021 6:11:34 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Namespace = root\virtualization\v2; NotificationQuery = SELECT * FROM __InstanceCreationEvent WITHIN 2 WHERE TargetInstance ISA 'Msvm_SyntheticEthernetPortSettingData' ; UserName = NT AUTHORITY\SYSTEM; ClientProcessID = 4232, ClientMachine = HV-CINDER-76377; PossibleCause = Temporary	5860	0	4611686018427387904	661	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	588	4948	hv-cinder-76377	S-1-5-18	9/15/2021 6:11:34 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Namespace = root\virtualization\v2; NotificationQuery = SELECT EnabledState, TargetInstance FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA 'Msvm_ComputerSystem' AND TargetInstance.EnabledState != PreviousInstance.EnabledState AND (TargetInstance.EnabledState = '2' OR TargetInstance.EnabledState = '3' OR TargetInstance.EnabledState = '32768' OR TargetInstance.EnabledState = '32769'); UserName = NT AUTHORITY\SYSTEM; ClientProcessID = 4848, ClientMachine = HV-CINDER-76377; PossibleCause = Temporary	5860	0	4611686018427387904	660	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	588	4948	hv-cinder-76377	S-1-5-18	9/15/2021 6:11:31 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WinTargetProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1216; ProviderPath = C:\windows\system32\wbem\WTWMIProv.dll	5857	0	4611686018427387904	659	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	1216	2028	hv-cinder-76377	S-1-5-19	9/15/2021 6:11:30 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WMIProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1352; ProviderPath = %systemroot%\system32\wbem\wmiprov.dll	5857	0	4611686018427387904	658	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	1352	3444	hv-cinder-76377	S-1-5-18	9/15/2021 6:11:30 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Win32_WIN32_TERMINALSERVICE_Prov provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3392; ProviderPath = %SystemRoot%\system32\tscfgwmi.dll	5857	0	4611686018427387904	657	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	3392	2512	hv-cinder-76377	S-1-5-20	9/15/2021 6:11:17 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4340; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll	5857	0	4611686018427387904	656	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	4340	1400	hv-cinder-76377	S-1-5-18	9/15/2021 6:11:06 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3392; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll	5857	0	4611686018427387904	655	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	3392	2512	hv-cinder-76377	S-1-5-20	9/15/2021 6:11:06 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3392; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll	5857	0	4611686018427387904	654	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	3392	2512	hv-cinder-76377	S-1-5-20	9/15/2021 6:11:06 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WMIProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4624; ProviderPath = %systemroot%\system32\wbem\wmiprov.dll	5857	0	4611686018427387904	653	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	4624	4588	hv-cinder-76377	S-1-5-18	9/15/2021 5:59:53 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32a provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2452; ProviderPath = %systemroot%\system32\wbem\wmipcima.dll	5857	0	4611686018427387904	652	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2452	5056	hv-cinder-76377	S-1-5-20	9/15/2021 5:58:52 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Win32_WIN32_TERMINALSERVICE_Prov provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2452; ProviderPath = %SystemRoot%\system32\tscfgwmi.dll	5857	0	4611686018427387904	651	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2452	4488	hv-cinder-76377	S-1-5-20	9/15/2021 5:58:52 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2452; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll	5857	0	4611686018427387904	650	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2452	5056	hv-cinder-76377	S-1-5-20	9/15/2021 5:58:52 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
MSIProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3648; ProviderPath = %systemroot%\system32\wbem\msiprov.dll	5857	0	4611686018427387904	649	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	3648	3680	hv-cinder-76377	S-1-5-18	9/15/2021 5:42:46 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {46719675-AA58-0005-DB99-714658AAD701}; ClientMachine = HV-CINDER-76377; User = HV-CINDER-76377\Admin; ClientProcessId = 1400; Component = Core; Operation = Start IWbemServices::ExecNotificationQuery - root\virtualization\v2 : SELECT * FROM __InstanceDeletionEvent WITHIN 2 WHERE TargetInstance ISA 'Msvm_ConcreteJob'; ResultCode = 0x800706BE; PossibleCause = Could not send status to client	5858	2	4611686018427387904	648	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	588	3724	hv-cinder-76377	S-1-5-18	9/15/2021 5:39:23 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {46719675-AA58-0005-DB99-714658AAD701}; ClientMachine = HV-CINDER-76377; User = HV-CINDER-76377\Admin; ClientProcessId = 1400; Component = Unknown; Operation = Start IWbemServices::ExecNotificationQuery - root\virtualization\v2 : SELECT * FROM __InstanceDeletionEvent WITHIN 2 WHERE TargetInstance ISA 'Msvm_ConcreteJob'; ResultCode = 0x80041032; PossibleCause = Unknown	5858	2	4611686018427387904	647	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	588	4040	hv-cinder-76377	S-1-5-18	9/15/2021 5:39:23 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {46719675-AA58-0005-DB99-714658AAD701}; ClientMachine = HV-CINDER-76377; User = HV-CINDER-76377\Admin; ClientProcessId = 1400; Component = Unknown; Operation = Start IWbemServices::ExecNotificationQuery - root\virtualization\v2 : SELECT * FROM __InstanceModificationEvent WITHIN 2 WHERE TargetInstance ISA 'Msvm_ConcreteJob'; ResultCode = 0x80041032; PossibleCause = Unknown	5858	2	4611686018427387904	646	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	588	4040	hv-cinder-76377	S-1-5-18	9/15/2021 5:39:21 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Namespace = root\virtualization\v2; NotificationQuery = SELECT * FROM __InstanceDeletionEvent WITHIN 2 WHERE TargetInstance ISA 'Msvm_ConcreteJob'; UserName = HV-CINDER-76377\Admin; ClientProcessID = 1400, ClientMachine = HV-CINDER-76377; PossibleCause = Temporary	5860	0	4611686018427387904	645	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	588	4040	hv-cinder-76377	S-1-5-18	9/15/2021 5:39:21 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Namespace = root\virtualization\v2; NotificationQuery = SELECT * FROM __InstanceModificationEvent WITHIN 2 WHERE TargetInstance ISA 'Msvm_ConcreteJob'; UserName = HV-CINDER-76377\Admin; ClientProcessID = 1400, ClientMachine = HV-CINDER-76377; PossibleCause = Temporary	5860	0	4611686018427387904	644	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	588	4040	hv-cinder-76377	S-1-5-18	9/15/2021 5:39:21 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NetAdapterCim provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3444; ProviderPath = %systemroot%\system32\wbem\NetAdapterCim.dll	5857	0	4611686018427387904	643	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	3444	2528	hv-cinder-76377	S-1-5-19	9/15/2021 5:39:21 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
nettcpip provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2948; ProviderPath = %systemroot%\system32\wbem\NetTCPIP.dll	5857	0	4611686018427387904	642	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2948	2976	hv-cinder-76377	S-1-5-20	9/15/2021 5:39:19 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
MSiSCSITargetProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1492; ProviderPath = C:\windows\system32\wbem\SmIscsiTargetProv.dll	5857	0	4611686018427387904	641	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	1492	84	hv-cinder-76377	S-1-5-20	9/15/2021 5:39:18 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WinTargetProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2524; ProviderPath = C:\windows\system32\wbem\WTWMIProv.dll	5857	0	4611686018427387904	640	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2524	2612	hv-cinder-76377	S-1-5-19	9/15/2021 5:39:17 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WMIProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3648; ProviderPath = %systemroot%\system32\wbem\wmiprov.dll	5857	0	4611686018427387904	639	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	3648	3684	hv-cinder-76377	S-1-5-18	9/15/2021 5:39:17 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
MSiSCSITargetProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1492; ProviderPath = C:\windows\system32\wbem\SmIscsiTargetProv.dll	5857	0	4611686018427387904	638	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	1492	3096	hv-cinder-76377	S-1-5-20	9/15/2021 5:39:17 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Win32_WIN32_TERMINALSERVICE_Prov provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2948; ProviderPath = %SystemRoot%\system32\tscfgwmi.dll	5857	0	4611686018427387904	637	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2948	2972	hv-cinder-76377	S-1-5-20	9/15/2021 5:39:06 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
wfascim provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2948; ProviderPath = %systemroot%\system32\wbem\wfascim.dll	5857	0	4611686018427387904	636	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2948	2976	hv-cinder-76377	S-1-5-20	9/15/2021 5:39:03 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3360; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll	5857	0	4611686018427387904	635	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	3360	4064	hv-cinder-76377	S-1-5-18	9/15/2021 5:38:33 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2948; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll	5857	0	4611686018427387904	634	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2948	2972	hv-cinder-76377	S-1-5-20	9/15/2021 5:38:33 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = HV-CINDER-76377; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3912; Component = Unknown; Operation = Start IWbemServices::CreateInstanceEnum - root\wmi : MSiSCSI_PortalInfoClass; ResultCode = 0x8004100C; PossibleCause = Unknown	5858	2	4611686018427387904	633	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	588	3188	hv-cinder-76377	S-1-5-18	9/15/2021 5:38:01 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = HV-CINDER-76377; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3912; Component = Unknown; Operation = Start IWbemServices::CreateInstanceEnum - root\wmi : MS_SM_AdapterInformationQuery; ResultCode = 0x8004100C; PossibleCause = Unknown	5858	2	4611686018427387904	632	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	588	3188	hv-cinder-76377	S-1-5-18	9/15/2021 5:38:01 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
wmiprov provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3648; ProviderPath = %systemroot%\system32\wbem\wmiprov.dll	5857	0	4611686018427387904	631	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	3648	3684	hv-cinder-76377	S-1-5-18	9/15/2021 5:38:01 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = HV-CINDER-76377; User = HV-CINDER-76377\cloudbase-init; ClientProcessId = 4056; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\cimv2 : SELECT RemainingWindowsReArmCount, KeyManagementServiceListeningPort, KeyManagementServiceDnsPublishing, KeyManagementServiceLowPriority, ClientMachineId, KeyManagementServiceHostCaching, Version FROM SoftwareLicensingService; ResultCode = 0x80041032; PossibleCause = Unknown	5858	2	4611686018427387904	630	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	588	2904	hv-cinder-76377	S-1-5-18	9/15/2021 5:37:58 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
SppProvider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2948; ProviderPath = %SystemRoot%\System32\sppwmi.dll	5857	0	4611686018427387904	629	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2948	2972	hv-cinder-76377	S-1-5-20	9/15/2021 5:37:57 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = HV-CINDER-76377; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1312; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\Microsoft\Windows\DeviceGuard : SELECT AvailableSecurityProperties FROM Win32_DeviceGuard ; ResultCode = 0x80041032; PossibleCause = Unknown	5858	2	4611686018427387904	628	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	588	2908	hv-cinder-76377	S-1-5-18	9/15/2021 5:37:42 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = HV-CINDER-76377; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1312; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\Microsoft\Windows\DeviceGuard : SELECT RequiredSecurityProperties FROM Win32_DeviceGuard ; ResultCode = 0x80041032; PossibleCause = Unknown	5858	2	4611686018427387904	627	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	588	2908	hv-cinder-76377	S-1-5-18	9/15/2021 5:37:41 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = HV-CINDER-76377; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1312; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\Microsoft\Windows\DeviceGuard : SELECT SecurityServicesConfigured FROM Win32_DeviceGuard ; ResultCode = 0x80041032; PossibleCause = Unknown	5858	2	4611686018427387904	626	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	588	2864	hv-cinder-76377	S-1-5-18	9/15/2021 5:37:41 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Win32_TpmProvider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2948; ProviderPath = C:\Windows\system32\wbem\Win32_TPM.dll	5857	0	4611686018427387904	625	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2948	2976	hv-cinder-76377	S-1-5-20	9/15/2021 5:37:41 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = HV-CINDER-76377; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1312; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\Microsoft\Windows\DeviceGuard : SELECT VirtualizationBasedSecurityStatus FROM Win32_DeviceGuard ; ResultCode = 0x80041032; PossibleCause = Unknown	5858	2	4611686018427387904	624	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	588	2752	hv-cinder-76377	S-1-5-18	9/15/2021 5:37:41 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = HV-CINDER-76377; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1312; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\Microsoft\Windows\DeviceGuard : SELECT SecurityServicesRunning FROM Win32_DeviceGuard ; ResultCode = 0x80041032; PossibleCause = Unknown	5858	2	4611686018427387904	623	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	588	2864	hv-cinder-76377	S-1-5-18	9/15/2021 5:37:41 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = HV-CINDER-76377; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1312; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\Microsoft\Windows\DeviceGuard : SELECT SecurityServicesRunning FROM Win32_DeviceGuard ; ResultCode = 0x80041032; PossibleCause = Unknown	5858	2	4611686018427387904	622	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	588	2752	hv-cinder-76377	S-1-5-18	9/15/2021 5:37:41 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = HV-CINDER-76377; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1312; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\Microsoft\Windows\DeviceGuard : SELECT AvailableSecurityProperties FROM Win32_DeviceGuard ; ResultCode = 0x80041032; PossibleCause = Unknown	5858	2	4611686018427387904	621	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	588	2864	hv-cinder-76377	S-1-5-18	9/15/2021 5:37:41 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = HV-CINDER-76377; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1312; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\Microsoft\Windows\DeviceGuard : SELECT RequiredSecurityProperties FROM Win32_DeviceGuard ; ResultCode = 0x80041032; PossibleCause = Unknown	5858	2	4611686018427387904	620	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	588	2752	hv-cinder-76377	S-1-5-18	9/15/2021 5:37:41 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = HV-CINDER-76377; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1312; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\Microsoft\Windows\DeviceGuard : SELECT VirtualizationBasedSecurityStatus FROM Win32_DeviceGuard ; ResultCode = 0x80041032; PossibleCause = Unknown	5858	2	4611686018427387904	619	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	588	2752	hv-cinder-76377	S-1-5-18	9/15/2021 5:37:41 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = HV-CINDER-76377; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1312; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\Microsoft\Windows\DeviceGuard : SELECT SecurityServicesRunning FROM Win32_DeviceGuard ; ResultCode = 0x80041032; PossibleCause = Unknown	5858	2	4611686018427387904	618	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	588	2864	hv-cinder-76377	S-1-5-18	9/15/2021 5:37:41 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = HV-CINDER-76377; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1312; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\Microsoft\Windows\DeviceGuard : SELECT SecurityServicesRunning FROM Win32_DeviceGuard ; ResultCode = 0x80041032; PossibleCause = Unknown	5858	2	4611686018427387904	617	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	588	2904	hv-cinder-76377	S-1-5-18	9/15/2021 5:37:41 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Win32_DeviceGuard provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2948; ProviderPath = %SystemRoot%\System32\Win32_DeviceGuard.dll	5857	0	4611686018427387904	616	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2948	2976	hv-cinder-76377	S-1-5-20	9/15/2021 5:37:41 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = HV-CINDER-76377; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1312; Component = Unknown; Operation = Start IWbemServices::ExecQuery - ROOT\CIMV2 : select ChassisTypes from Win32_SystemEnclosure; ResultCode = 0x80041032; PossibleCause = Unknown	5858	2	4611686018427387904	615	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	588	2904	hv-cinder-76377	S-1-5-18	9/15/2021 5:37:40 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = HV-CINDER-76377; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1312; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\CIMV2 : SELECT SMBIOSAssetTag FROM Win32_SystemEnclosure ; ResultCode = 0x80041032; PossibleCause = Unknown	5858	2	4611686018427387904	614	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	588	2908	hv-cinder-76377	S-1-5-18	9/15/2021 5:37:40 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = HV-CINDER-76377; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1312; Component = Unknown; Operation = Start IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT ID FROM Win32_ServerFeature; ResultCode = 0x80041032; PossibleCause = Unknown	5858	2	4611686018427387904	613	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	588	2864	hv-cinder-76377	S-1-5-18	9/15/2021 5:37:39 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3360; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll	5857	0	4611686018427387904	612	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	3360	876	hv-cinder-76377	S-1-5-18	9/15/2021 5:37:34 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
ServerFeatureProvider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2948; ProviderPath = %windir%\system32\wbem\servercompprov.dll	5857	0	4611686018427387904	611	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2948	2972	hv-cinder-76377	S-1-5-20	9/15/2021 5:37:34 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {8F02AC11-A06C-4ED3-9197-113622716E6F}; ClientMachine = HV-CINDER-76377; User = ; ClientProcessId = 588; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{FC491EF1-C4AA-4CE1-B329-414B101DB823}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	610	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	588	2880	hv-cinder-76377	S-1-5-18	9/15/2021 5:37:26 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {8F02AC11-A06C-4ED3-9197-113622716E6F}; ClientMachine = HV-CINDER-76377; User = ; ClientProcessId = 588; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{fbf687e6-f063-4d9f-9f4f-fd9a26acdd5f}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	609	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	588	2880	hv-cinder-76377	S-1-5-18	9/15/2021 5:37:26 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {8F02AC11-A06C-4ED3-9197-113622716E6F}; ClientMachine = HV-CINDER-76377; User = ; ClientProcessId = 588; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{FB2CA36D-0B40-4307-821B-A13B252DE56C}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	608	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	588	2880	hv-cinder-76377	S-1-5-18	9/15/2021 5:37:26 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {8F02AC11-A06C-4ED3-9197-113622716E6F}; ClientMachine = HV-CINDER-76377; User = ; ClientProcessId = 588; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{f3ccc681-b74c-4060-9f26-cd84525dca2a}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	607	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	588	2880	hv-cinder-76377	S-1-5-18	9/15/2021 5:37:26 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {8F02AC11-A06C-4ED3-9197-113622716E6F}; ClientMachine = HV-CINDER-76377; User = ; ClientProcessId = 588; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{F312195E-3D9D-447A-A3F5-08DFFA24735E}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	606	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	588	2880	hv-cinder-76377	S-1-5-18	9/15/2021 5:37:26 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {8F02AC11-A06C-4ED3-9197-113622716E6F}; ClientMachine = HV-CINDER-76377; User = ; ClientProcessId = 588; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{E62688F0-25FD-4c90-BFF5-F508B9D2E31F}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	605	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	588	2880	hv-cinder-76377	S-1-5-18	9/15/2021 5:37:26 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {8F02AC11-A06C-4ED3-9197-113622716E6F}; ClientMachine = HV-CINDER-76377; User = ; ClientProcessId = 588; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{E5094040-C46C-4115-B030-04FB2E545B00}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	604	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	588	2880	hv-cinder-76377	S-1-5-18	9/15/2021 5:37:26 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {8F02AC11-A06C-4ED3-9197-113622716E6F}; ClientMachine = HV-CINDER-76377; User = ; ClientProcessId = 588; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{E4F48E54-F38D-4884-BFB9-D4D2E5729C18}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	603	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	588	2880	hv-cinder-76377	S-1-5-18	9/15/2021 5:37:26 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {8F02AC11-A06C-4ED3-9197-113622716E6F}; ClientMachine = HV-CINDER-76377; User = ; ClientProcessId = 588; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{e437bc1c-aa7d-11d2-a382-00c04f991e27}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	602	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	588	2880	hv-cinder-76377	S-1-5-18	9/15/2021 5:37:26 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {8F02AC11-A06C-4ED3-9197-113622716E6F}; ClientMachine = HV-CINDER-76377; User = ; ClientProcessId = 588; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{CF7639F3-ABA2-41DB-97F2-81E2C5DBFC5D}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	601	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	588	2880	hv-cinder-76377	S-1-5-18	9/15/2021 5:37:26 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {8F02AC11-A06C-4ED3-9197-113622716E6F}; ClientMachine = HV-CINDER-76377; User = ; ClientProcessId = 588; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{cdeafc3d-948d-49dd-ab12-e578ba4af7aa}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	600	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	588	2880	hv-cinder-76377	S-1-5-18	9/15/2021 5:37:26 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {8F02AC11-A06C-4ED3-9197-113622716E6F}; ClientMachine = HV-CINDER-76377; User = ; ClientProcessId = 588; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{c6dc5466-785a-11d2-84d0-00c04fb169f7}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	599	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	588	2880	hv-cinder-76377	S-1-5-18	9/15/2021 5:37:26 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {8F02AC11-A06C-4ED3-9197-113622716E6F}; ClientMachine = HV-CINDER-76377; User = ; ClientProcessId = 588; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{C631DF4C-088F-4156-B058-4375F0853CD8}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	598	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	588	2880	hv-cinder-76377	S-1-5-18	9/15/2021 5:37:26 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {8F02AC11-A06C-4ED3-9197-113622716E6F}; ClientMachine = HV-CINDER-76377; User = ; ClientProcessId = 588; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{C418DD9D-0D14-4efb-8FBF-CFE535C8FAC7}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	597	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	588	2880	hv-cinder-76377	S-1-5-18	9/15/2021 5:37:26 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {8F02AC11-A06C-4ED3-9197-113622716E6F}; ClientMachine = HV-CINDER-76377; User = ; ClientProcessId = 588; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{C34B2751-1CF4-44F5-9262-C3FC39666591}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	596	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	588	2880	hv-cinder-76377	S-1-5-18	9/15/2021 5:37:26 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {8F02AC11-A06C-4ED3-9197-113622716E6F}; ClientMachine = HV-CINDER-76377; User = ; ClientProcessId = 588; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{BC75B1ED-5833-4858-9BB8-CBF0B166DF9D}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	595	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	588	2880	hv-cinder-76377	S-1-5-18	9/15/2021 5:37:26 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {8F02AC11-A06C-4ED3-9197-113622716E6F}; ClientMachine = HV-CINDER-76377; User = ; ClientProcessId = 588; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{BA649533-0AAC-4E04-B9BC-4DBAE0325B12}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	594	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	588	2880	hv-cinder-76377	S-1-5-18	9/15/2021 5:37:26 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {8F02AC11-A06C-4ED3-9197-113622716E6F}; ClientMachine = HV-CINDER-76377; User = ; ClientProcessId = 588; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{B587E2B1-4D59-4e7e-AED9-22B9DF11D053}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	593	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	588	2880	hv-cinder-76377	S-1-5-18	9/15/2021 5:37:26 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {8F02AC11-A06C-4ED3-9197-113622716E6F}; ClientMachine = HV-CINDER-76377; User = ; ClientProcessId = 588; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{B087BE9D-ED37-454f-AF9C-04291E351182}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	592	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	588	2880	hv-cinder-76377	S-1-5-18	9/15/2021 5:37:26 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {8F02AC11-A06C-4ED3-9197-113622716E6F}; ClientMachine = HV-CINDER-76377; User = ; ClientProcessId = 588; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{AADCED64-746C-4633-A97C-D61349046527}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	591	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	588	2880	hv-cinder-76377	S-1-5-18	9/15/2021 5:37:26 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {8F02AC11-A06C-4ED3-9197-113622716E6F}; ClientMachine = HV-CINDER-76377; User = ; ClientProcessId = 588; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{A3F3E39B-5D83-4940-B954-28315B82F0A8}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	590	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	588	2880	hv-cinder-76377	S-1-5-18	9/15/2021 5:37:26 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {8F02AC11-A06C-4ED3-9197-113622716E6F}; ClientMachine = HV-CINDER-76377; User = ; ClientProcessId = 588; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{91FBB303-0CD5-4055-BF42-E512A681B325}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	589	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	588	2880	hv-cinder-76377	S-1-5-18	9/15/2021 5:37:26 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {8F02AC11-A06C-4ED3-9197-113622716E6F}; ClientMachine = HV-CINDER-76377; User = ; ClientProcessId = 588; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{8A28E2C5-8D06-49A4-A08C-632DAA493E17}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	588	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	588	2880	hv-cinder-76377	S-1-5-18	9/15/2021 5:37:26 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {8F02AC11-A06C-4ED3-9197-113622716E6F}; ClientMachine = HV-CINDER-76377; User = ; ClientProcessId = 588; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{827D319E-6EAC-11D2-A4EA-00C04F79F83A}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	587	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	588	2880	hv-cinder-76377	S-1-5-18	9/15/2021 5:37:26 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {8F02AC11-A06C-4ED3-9197-113622716E6F}; ClientMachine = HV-CINDER-76377; User = ; ClientProcessId = 588; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{7B849a69-220F-451E-B3FE-2CB811AF94AE}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	586	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	588	2880	hv-cinder-76377	S-1-5-18	9/15/2021 5:37:26 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {8F02AC11-A06C-4ED3-9197-113622716E6F}; ClientMachine = HV-CINDER-76377; User = ; ClientProcessId = 588; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{7933F41E-56F8-41d6-A31C-4148A711EE93}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	585	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	588	2880	hv-cinder-76377	S-1-5-18	9/15/2021 5:37:26 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {8F02AC11-A06C-4ED3-9197-113622716E6F}; ClientMachine = HV-CINDER-76377; User = ; ClientProcessId = 588; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{74EE6C03-5363-4554-B161-627540339CAB}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	584	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	588	2880	hv-cinder-76377	S-1-5-18	9/15/2021 5:37:26 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {8F02AC11-A06C-4ED3-9197-113622716E6F}; ClientMachine = HV-CINDER-76377; User = ; ClientProcessId = 588; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{728EE579-943C-4519-9EF7-AB56765798ED}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	583	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	588	2880	hv-cinder-76377	S-1-5-18	9/15/2021 5:37:26 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {8F02AC11-A06C-4ED3-9197-113622716E6F}; ClientMachine = HV-CINDER-76377; User = ; ClientProcessId = 588; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{7150F9BF-48AD-4da4-A49C-29EF4A8369BA}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	582	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	588	2880	hv-cinder-76377	S-1-5-18	9/15/2021 5:37:26 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {8F02AC11-A06C-4ED3-9197-113622716E6F}; ClientMachine = HV-CINDER-76377; User = ; ClientProcessId = 588; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{6A4C88C6-C502-4f74-8F60-2CB23EDC24E2}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	581	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	588	2880	hv-cinder-76377	S-1-5-18	9/15/2021 5:37:26 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {8F02AC11-A06C-4ED3-9197-113622716E6F}; ClientMachine = HV-CINDER-76377; User = ; ClientProcessId = 588; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{6232C319-91AC-4931-9385-E70C2B099F0E}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	580	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	588	2880	hv-cinder-76377	S-1-5-18	9/15/2021 5:37:26 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {8F02AC11-A06C-4ED3-9197-113622716E6F}; ClientMachine = HV-CINDER-76377; User = ; ClientProcessId = 588; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{4CFB60C1-FAA6-47f1-89AA-0B18730C9FD3}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	579	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	588	2880	hv-cinder-76377	S-1-5-18	9/15/2021 5:37:26 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {8F02AC11-A06C-4ED3-9197-113622716E6F}; ClientMachine = HV-CINDER-76377; User = ; ClientProcessId = 588; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{4bcd6cde-777b-48b6-9804-43568e23545d}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	578	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	588	2880	hv-cinder-76377	S-1-5-18	9/15/2021 5:37:26 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {8F02AC11-A06C-4ED3-9197-113622716E6F}; ClientMachine = HV-CINDER-76377; User = ; ClientProcessId = 588; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{4B7C3B0F-E993-4E06-A241-3FBE06943684}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	577	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	588	2880	hv-cinder-76377	S-1-5-18	9/15/2021 5:37:26 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {8F02AC11-A06C-4ED3-9197-113622716E6F}; ClientMachine = HV-CINDER-76377; User = ; ClientProcessId = 588; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{42B5FAAE-6536-11d2-AE5A-0000F87571E3}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	576	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	588	2880	hv-cinder-76377	S-1-5-18	9/15/2021 5:37:26 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {8F02AC11-A06C-4ED3-9197-113622716E6F}; ClientMachine = HV-CINDER-76377; User = ; ClientProcessId = 588; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{426031c0-0b47-4852-b0ca-ac3d37bfcb39}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	575	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	588	2880	hv-cinder-76377	S-1-5-18	9/15/2021 5:37:26 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {8F02AC11-A06C-4ED3-9197-113622716E6F}; ClientMachine = HV-CINDER-76377; User = ; ClientProcessId = 588; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{3A0DBA37-F8B2-4356-83DE-3E90BD5C261F}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	574	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	588	2880	hv-cinder-76377	S-1-5-18	9/15/2021 5:37:26 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {8F02AC11-A06C-4ED3-9197-113622716E6F}; ClientMachine = HV-CINDER-76377; User = ; ClientProcessId = 588; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{3610eda5-77ef-11d2-8dc5-00c04fa31a66}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	573	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	588	2880	hv-cinder-76377	S-1-5-18	9/15/2021 5:37:26 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {8F02AC11-A06C-4ED3-9197-113622716E6F}; ClientMachine = HV-CINDER-76377; User = ; ClientProcessId = 588; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{2BFCC077-22D2-48DE-BDE1-2F618D9B476D}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	572	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	588	2880	hv-cinder-76377	S-1-5-18	9/15/2021 5:37:26 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {8F02AC11-A06C-4ED3-9197-113622716E6F}; ClientMachine = HV-CINDER-76377; User = ; ClientProcessId = 588; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{2A8FDC61-2347-4C87-92F6-B05EB91A201A}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	571	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	588	2880	hv-cinder-76377	S-1-5-18	9/15/2021 5:37:26 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {8F02AC11-A06C-4ED3-9197-113622716E6F}; ClientMachine = HV-CINDER-76377; User = ; ClientProcessId = 588; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{1A6364EB-776B-4120-ADE1-B63A406A76B5}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	570	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	588	2880	hv-cinder-76377	S-1-5-18	9/15/2021 5:37:26 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {8F02AC11-A06C-4ED3-9197-113622716E6F}; ClientMachine = HV-CINDER-76377; User = ; ClientProcessId = 588; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{17D89FEC-5C44-4972-B12D-241CAEF74509}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	569	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	588	2880	hv-cinder-76377	S-1-5-18	9/15/2021 5:37:26 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {8F02AC11-A06C-4ED3-9197-113622716E6F}; ClientMachine = HV-CINDER-76377; User = ; ClientProcessId = 588; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{16be69fa-4209-4250-88cb-716cf41954e0}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	568	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	588	2880	hv-cinder-76377	S-1-5-18	9/15/2021 5:37:26 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {8F02AC11-A06C-4ED3-9197-113622716E6F}; ClientMachine = HV-CINDER-76377; User = ; ClientProcessId = 588; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{169EBF44-942F-4C43-87CE-13C93996EBBE}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	567	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	588	2880	hv-cinder-76377	S-1-5-18	9/15/2021 5:37:26 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {8F02AC11-A06C-4ED3-9197-113622716E6F}; ClientMachine = HV-CINDER-76377; User = ; ClientProcessId = 588; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{0E28E245-9368-4853-AD84-6DA3BA35BB75}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	566	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	588	2880	hv-cinder-76377	S-1-5-18	9/15/2021 5:37:26 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {8F02AC11-A06C-4ED3-9197-113622716E6F}; ClientMachine = HV-CINDER-76377; User = ; ClientProcessId = 588; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{0ACDD40C-75AC-47ab-BAA0-BF6DE7E7FE63}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	565	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	588	2880	hv-cinder-76377	S-1-5-18	9/15/2021 5:37:26 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Namespace = //./root/CIMV2; NotificationQuery = select * from MSFT_SCMEventLogEvent; OwnerName = S-1-5-32-544; HostProcessID = 588; Provider= SCM Event Provider, queryID = 0; PossibleCause = Permanent	5859	0	4611686018427387904	564	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	588	4040	hv-cinder-76377	S-1-5-18	9/15/2021 5:37:24 PM	46719675-aa58-0005-fc96-714658aad701	microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Namespace = root\virtualization\v2; NotificationQuery = SELECT * FROM __ClassOperationEvent; UserName = .\SYSTEM; ClientProcessID = 0, ClientMachine = ; PossibleCause = Temporary	5860	0	4611686018427387904	563	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	588	2880	hv-cinder-76377	S-1-5-18	9/15/2021 5:37:24 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Namespace = //./root/subscription; Eventfilter = SCM Event Log Filter (refer to its activate eventid:5859); Consumer = NTEventLogEventConsumer="SCM Event Log Consumer"; PossibleCause = Binding EventFilter: instance of __EventFilter { CreatorSID = {1, 2, 0, 0, 0, 0, 0, 5, 32, 0, 0, 0, 32, 2, 0, 0}; EventNamespace = "root\\cimv2"; Name = "SCM Event Log Filter"; Query = "select * from MSFT_SCMEventLogEvent"; QueryLanguage = "WQL"; }; Perm. Consumer: instance of NTEventLogEventConsumer { Category = 0; CreatorSID = {1, 2, 0, 0, 0, 0, 0, 5, 32, 0, 0, 0, 32, 2, 0, 0}; EventType = 1; Name = "SCM Event Log Consumer"; NameOfUserSIDProperty = "sid"; SourceName = "Service Control Manager"; };	5861	0	4611686018427387904	562	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	588	4036	hv-cinder-76377	S-1-5-18	9/15/2021 5:37:24 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32a provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2948; ProviderPath = %systemroot%\system32\wbem\wmipcima.dll	5857	0	4611686018427387904	561	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2948	2972	hv-cinder-76377	S-1-5-20	9/15/2021 5:37:23 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WMIProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3648; ProviderPath = %systemroot%\system32\wbem\wmiprov.dll	5857	0	4611686018427387904	560	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	3648	3684	hv-cinder-76377	S-1-5-18	9/15/2021 5:37:23 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WMIProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3648; ProviderPath = %systemroot%\system32\wbem\wmiprov.dll	5857	0	4611686018427387904	559	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	3648	3684	hv-cinder-76377	S-1-5-18	9/15/2021 5:37:23 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2948; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll	5857	0	4611686018427387904	558	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2948	2988	hv-cinder-76377	S-1-5-20	9/15/2021 5:37:18 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = HV-CINDER-76377; User = NT AUTHORITY\SYSTEM; ClientProcessId = 2532; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\virtualization\v2 : Msvm_ResourcePoolComponent.Name="Microsoft\|RDV Integration Component Resource Pool\|V2.0"; ResultCode = 0x80041010; PossibleCause = Unknown	5858	2	4611686018427387904	557	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	588	2900	hv-cinder-76377	S-1-5-18	9/15/2021 5:37:18 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = HV-CINDER-76377; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1772; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User : __Namespace.name="S_1_5_21_1252192876_1650582965_1798054237_500"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	556	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	588	2884	hv-cinder-76377	S-1-5-18	9/15/2021 5:37:18 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-4OUNCN70RI2; User = NT AUTHORITY\SYSTEM; ClientProcessId = 2156; Component = Unknown; Operation = Start IWbemServices::CreateInstanceEnum - root\wmi : MSiSCSI_PortalInfoClass; ResultCode = 0x8004100A; PossibleCause = Unknown	5858	2	4611686018427387904	555	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	528	2824	WIN-5T344G8GM1H	S-1-5-18	9/15/2021 5:36:46 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-4OUNCN70RI2; User = NT AUTHORITY\SYSTEM; ClientProcessId = 2156; Component = Unknown; Operation = Start IWbemServices::CreateInstanceEnum - root\wmi : MS_SM_AdapterInformationQuery; ResultCode = 0x8004100A; PossibleCause = Unknown	5858	2	4611686018427387904	554	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	528	2824	WIN-5T344G8GM1H	S-1-5-18	9/15/2021 5:36:46 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-4OUNCN70RI2; User = NT AUTHORITY\SYSTEM; ClientProcessId = 2196; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\virtualization\v2 : Msvm_ResourcePoolComponent.Name="Microsoft\|RDV Integration Component Resource Pool\|V2.0"; ResultCode = 0x80041010; PossibleCause = Unknown	5858	2	4611686018427387904	553	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	528	2420	WIN-5T344G8GM1H	S-1-5-18	9/15/2021 5:35:55 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-4OUNCN70RI2; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1748; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\cimv2 : select * from Win32_OperatingSystem; ResultCode = 0x8004100A; PossibleCause = Unknown	5858	2	4611686018427387904	552	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	528	2420	WIN-5T344G8GM1H	S-1-5-18	9/15/2021 5:35:55 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4848; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\wmi : select * from WDMClassesOfDriver where ClassName = "RNDISMPStatisticsOID"; ResultCode = 0x80041032; PossibleCause = Unknown	5858	2	4611686018427387904	551	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	976	3432	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:48:09 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4848; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\wmi : select * from WMIBinaryMofResource where Name = "C:\\windows\\System32\\drivers\\en-US\\netvsc.sys.mui[NdisMofResource]"; ResultCode = 0x80041032; PossibleCause = Unknown	5858	2	4611686018427387904	550	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	976	3432	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:48:09 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
MSVDS__PROVIDER provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4460; ProviderPath = %systemroot%\system32\wbem\vdswmi.dll	5857	0	4611686018427387904	549	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	4460	5048	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 9:46:31 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4460; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll	5857	0	4611686018427387904	548	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	4460	5048	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 9:46:31 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WMIProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4848; ProviderPath = %systemroot%\system32\wbem\wmiprov.dll	5857	0	4611686018427387904	547	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	4848	4776	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:45:30 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = WIN-5T344G8GM1H\Administrator; ClientProcessId = 4956; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\Microsoft\Windows\Defender : SELECT * FROM MSFT_MpComputerStatus; ResultCode = 0x80041032; PossibleCause = Unknown	5858	2	4611686018427387904	546	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	976	1176	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:42:52 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
ProtectionManagement provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3752; ProviderPath = "%ProgramData%\Microsoft\Windows Defender\Platform\4.12.17007.18011-0\ProtectionManagement.dll"	5857	0	4611686018427387904	545	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	3752	2228	WIN-5T344G8GM1H	S-1-5-19	1/19/2018 9:42:52 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
MsNetImPlatform provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2776; ProviderPath = %systemroot%\system32\wbem\ndisimplatcim.dll	5857	0	4611686018427387904	544	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2776	3064	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 9:42:52 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4120; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll	5857	0	4611686018427387904	543	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	4120	4148	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:42:50 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
nettcpip provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2776; ProviderPath = %systemroot%\system32\wbem\NetTCPIP.dll	5857	0	4611686018427387904	542	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2776	1292	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 9:42:48 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NetAdapterCim provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3752; ProviderPath = %systemroot%\system32\wbem\NetAdapterCim.dll	5857	0	4611686018427387904	541	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	3752	2228	WIN-5T344G8GM1H	S-1-5-19	1/19/2018 9:42:48 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2776; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll	5857	0	4611686018427387904	540	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2776	3064	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 9:42:48 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
MSVDS__PROVIDER provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2776; ProviderPath = %systemroot%\system32\wbem\vdswmi.dll	5857	0	4611686018427387904	539	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2776	3064	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 9:42:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32a provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2776; ProviderPath = %systemroot%\system32\wbem\wmipcima.dll	5857	0	4611686018427387904	538	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2776	3064	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 9:42:16 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4120; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll	5857	0	4611686018427387904	537	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	4120	4148	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:41:43 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
nettcpip provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2776; ProviderPath = %systemroot%\system32\wbem\NetTCPIP.dll	5857	0	4611686018427387904	536	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2776	1292	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 9:41:39 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NetAdapterCim provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3752; ProviderPath = %systemroot%\system32\wbem\NetAdapterCim.dll	5857	0	4611686018427387904	535	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	3752	2228	WIN-5T344G8GM1H	S-1-5-19	1/19/2018 9:41:39 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2776; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll	5857	0	4611686018427387904	534	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2776	2812	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 9:41:39 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Namespace = //./root/CIMV2; NotificationQuery = select * from MSFT_SCMEventLogEvent; OwnerName = S-1-5-32-544; HostProcessID = 976; Provider= SCM Event Provider, queryID = 0; PossibleCause = Permanent	5859	0	4611686018427387904	533	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	976	2172	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:41:32 AM	ad8d0f9c-9109-0001-0a10-8dad0991d301	microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Namespace = root\virtualization\v2; NotificationQuery = SELECT * FROM __ClassOperationEvent; UserName = .\SYSTEM; ClientProcessID = 0, ClientMachine = ; PossibleCause = Temporary	5860	0	4611686018427387904	532	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	976	2680	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:41:32 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Namespace = //./root/subscription; Eventfilter = SCM Event Log Filter (refer to its activate eventid:5859); Consumer = NTEventLogEventConsumer="SCM Event Log Consumer"; PossibleCause = Binding EventFilter: instance of __EventFilter { CreatorSID = {1, 2, 0, 0, 0, 0, 0, 5, 32, 0, 0, 0, 32, 2, 0, 0}; EventNamespace = "root\\cimv2"; Name = "SCM Event Log Filter"; Query = "select * from MSFT_SCMEventLogEvent"; QueryLanguage = "WQL"; }; Perm. Consumer: instance of NTEventLogEventConsumer { Category = 0; CreatorSID = {1, 2, 0, 0, 0, 0, 0, 5, 32, 0, 0, 0, 32, 2, 0, 0}; EventType = 1; Name = "SCM Event Log Consumer"; NameOfUserSIDProperty = "sid"; SourceName = "Service Control Manager"; };	5861	0	4611686018427387904	531	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	976	388	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:41:32 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{FC491EF1-C4AA-4CE1-B329-414B101DB823}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	530	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	976	2680	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:41:32 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{fbf687e6-f063-4d9f-9f4f-fd9a26acdd5f}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	529	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	976	2680	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:41:32 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{FB2CA36D-0B40-4307-821B-A13B252DE56C}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	528	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	976	2680	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:41:32 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{f3ccc681-b74c-4060-9f26-cd84525dca2a}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	527	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	976	2680	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:41:32 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{F312195E-3D9D-447A-A3F5-08DFFA24735E}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	526	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	976	2680	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:41:32 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{E62688F0-25FD-4c90-BFF5-F508B9D2E31F}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	525	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	976	2680	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:41:32 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{E5094040-C46C-4115-B030-04FB2E545B00}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	524	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	976	2680	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:41:32 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{E4F48E54-F38D-4884-BFB9-D4D2E5729C18}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	523	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	976	2680	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:41:32 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{e437bc1c-aa7d-11d2-a382-00c04f991e27}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	522	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	976	2680	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:41:32 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{CF7639F3-ABA2-41DB-97F2-81E2C5DBFC5D}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	521	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	976	2680	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:41:32 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{cdeafc3d-948d-49dd-ab12-e578ba4af7aa}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	520	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	976	2680	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:41:32 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{c6dc5466-785a-11d2-84d0-00c04fb169f7}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	519	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	976	2680	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:41:32 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{C631DF4C-088F-4156-B058-4375F0853CD8}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	518	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	976	2680	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:41:32 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{C418DD9D-0D14-4efb-8FBF-CFE535C8FAC7}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	517	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	976	2680	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:41:32 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{C34B2751-1CF4-44F5-9262-C3FC39666591}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	516	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	976	2680	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:41:32 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{BC75B1ED-5833-4858-9BB8-CBF0B166DF9D}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	515	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	976	2680	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:41:32 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{BA649533-0AAC-4E04-B9BC-4DBAE0325B12}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	514	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	976	2680	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:41:32 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{B587E2B1-4D59-4e7e-AED9-22B9DF11D053}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	513	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	976	2680	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:41:32 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{B087BE9D-ED37-454f-AF9C-04291E351182}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	512	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	976	2680	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:41:32 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{AADCED64-746C-4633-A97C-D61349046527}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	511	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	976	2680	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:41:32 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{A3F3E39B-5D83-4940-B954-28315B82F0A8}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	510	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	976	2680	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:41:32 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{91FBB303-0CD5-4055-BF42-E512A681B325}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	509	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	976	2680	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:41:32 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{8A28E2C5-8D06-49A4-A08C-632DAA493E17}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	508	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	976	2680	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:41:32 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{827D319E-6EAC-11D2-A4EA-00C04F79F83A}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	507	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	976	2680	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:41:32 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{7B849a69-220F-451E-B3FE-2CB811AF94AE}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	506	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	976	2680	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:41:32 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{7933F41E-56F8-41d6-A31C-4148A711EE93}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	505	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	976	2680	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:41:32 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{74EE6C03-5363-4554-B161-627540339CAB}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	504	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	976	2680	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:41:32 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{728EE579-943C-4519-9EF7-AB56765798ED}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	503	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	976	2680	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:41:32 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{7150F9BF-48AD-4da4-A49C-29EF4A8369BA}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	502	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	976	2680	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:41:32 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{6A4C88C6-C502-4f74-8F60-2CB23EDC24E2}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	501	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	976	2680	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:41:32 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{6232C319-91AC-4931-9385-E70C2B099F0E}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	500	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	976	2680	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:41:32 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{4CFB60C1-FAA6-47f1-89AA-0B18730C9FD3}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	499	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	976	2680	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:41:32 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{4bcd6cde-777b-48b6-9804-43568e23545d}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	498	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	976	2680	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:41:32 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{4B7C3B0F-E993-4E06-A241-3FBE06943684}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	497	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	976	2680	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:41:32 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{42B5FAAE-6536-11d2-AE5A-0000F87571E3}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	496	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	976	2680	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:41:32 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{426031c0-0b47-4852-b0ca-ac3d37bfcb39}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	495	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	976	2680	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:41:32 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{3A0DBA37-F8B2-4356-83DE-3E90BD5C261F}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	494	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	976	2680	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:41:32 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{3610eda5-77ef-11d2-8dc5-00c04fa31a66}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	493	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	976	2680	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:41:32 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{2BFCC077-22D2-48DE-BDE1-2F618D9B476D}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	492	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	976	2680	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:41:32 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{2A8FDC61-2347-4C87-92F6-B05EB91A201A}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	491	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	976	2680	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:41:32 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{1A6364EB-776B-4120-ADE1-B63A406A76B5}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	490	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	976	2680	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:41:32 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{17D89FEC-5C44-4972-B12D-241CAEF74509}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	489	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	976	2680	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:41:32 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{16be69fa-4209-4250-88cb-716cf41954e0}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	488	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	976	2680	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:41:32 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{169EBF44-942F-4C43-87CE-13C93996EBBE}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	487	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	976	2680	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:41:32 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{0E28E245-9368-4853-AD84-6DA3BA35BB75}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	486	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	976	2680	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:41:32 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{0ACDD40C-75AC-47ab-BAA0-BF6DE7E7FE63}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	485	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	976	2680	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:41:32 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2776; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll	5857	0	4611686018427387904	484	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2776	2848	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 9:41:31 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 2204; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\virtualization\v2 : Msvm_ResourcePoolComponent.Name="Microsoft\|RDV Integration Component Resource Pool\|V2.0"; ResultCode = 0x80041010; PossibleCause = Unknown	5858	2	4611686018427387904	483	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	976	2692	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:41:30 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3176; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll	5857	0	4611686018427387904	482	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	3176	1548	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 9:40:26 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3952; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\interop\ms_409 : MSFTSM_RegisteredSubprofile; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	481	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	4728	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:38:50 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3952; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\interop\ms_409 : MSFTSM_SubProfileRequiresProfile; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	480	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	4728	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:38:50 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3952; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\interop\ms_409 : MSFTSM_RegisteredProfile; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	479	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	4728	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:38:50 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3952; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\interop\ms_409 : MSFTSM_ReferencedProfile; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	478	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	4728	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:38:50 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3952; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\interop\ms_409 : MSFTSM_ElementSoftwareIdentity; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	477	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	4728	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:38:50 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3952; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\interop\ms_409 : MSFTSM_ElementConformsToProfileEx; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	476	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	4728	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:38:50 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3952; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\interop\ms_409 : MSFTSM_ElementConformsToProfile; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	475	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	4728	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:38:50 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3952; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\cimv2\storage\ms_409 : __Namespace.Name='iscsitarget'; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	474	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	4728	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:38:50 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WMIProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3968; ProviderPath = %systemroot%\system32\wbem\wmiprov.dll	5857	0	4611686018427387904	473	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	3968	4084	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:38:50 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
MSVDS__PROVIDER provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2712; ProviderPath = %systemroot%\system32\wbem\vdswmi.dll	5857	0	4611686018427387904	472	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2712	592	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 9:38:50 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2712; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll	5857	0	4611686018427387904	471	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2712	592	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 9:38:49 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
nettcpip provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4348; ProviderPath = %systemroot%\system32\wbem\NetTCPIP.dll	5857	0	4611686018427387904	470	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	4348	2924	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 9:35:55 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NetAdapterCim provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4444; ProviderPath = %systemroot%\system32\wbem\NetAdapterCim.dll	5857	0	4611686018427387904	469	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	4444	4516	WIN-5T344G8GM1H	S-1-5-19	1/19/2018 9:35:55 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4348; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll	5857	0	4611686018427387904	468	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	4348	4632	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 9:35:55 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
MSVDS__PROVIDER provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4348; ProviderPath = %systemroot%\system32\wbem\vdswmi.dll	5857	0	4611686018427387904	467	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	4348	4632	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 9:35:41 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4348; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll	5857	0	4611686018427387904	466	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	4348	4632	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 9:35:41 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
nettcpip provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4824; ProviderPath = %systemroot%\system32\wbem\NetTCPIP.dll	5857	0	4611686018427387904	465	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	4824	1600	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 9:34:04 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NetAdapterCim provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1548; ProviderPath = %systemroot%\system32\wbem\NetAdapterCim.dll	5857	0	4611686018427387904	464	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	1548	2160	WIN-5T344G8GM1H	S-1-5-19	1/19/2018 9:34:04 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4824; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll	5857	0	4611686018427387904	463	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	4824	1600	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 9:34:04 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4824; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll	5857	0	4611686018427387904	462	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	4824	4808	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 9:34:04 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 764; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll	5857	0	4611686018427387904	461	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	764	1020	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:33:46 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
MSVDS__PROVIDER provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4824; ProviderPath = %systemroot%\system32\wbem\vdswmi.dll	5857	0	4611686018427387904	460	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	4824	4808	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 9:32:20 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4824; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll	5857	0	4611686018427387904	459	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	4824	4808	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 9:32:20 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WMIProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3968; ProviderPath = %systemroot%\system32\wbem\wmiprov.dll	5857	0	4611686018427387904	458	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	3968	4084	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:31:16 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
MSVDS__PROVIDER provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1520; ProviderPath = %systemroot%\system32\wbem\vdswmi.dll	5857	0	4611686018427387904	457	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	1520	2704	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 9:29:44 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1520; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll	5857	0	4611686018427387904	456	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	1520	2704	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 9:29:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {4693033F-66F0-46C4-8E27-99621765768B}; ClientMachine = WIN-5T344G8GM1H; User = WIN-5T344G8GM1H\Administrator; ClientProcessId = 4124; Component = Core; Operation = Start IWbemServices::ExecMethod - root\microsoft\windows\servermanager : MSFT_ServerManagerTasks::GetServerFeature; ResultCode = 0x800706BE; PossibleCause = Could not send status to client	5858	2	4611686018427387904	455	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2716	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:32 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {4693033F-66F0-46C4-8E27-99621765768B}; ClientMachine = WIN-5T344G8GM1H; User = WIN-5T344G8GM1H\Administrator; ClientProcessId = 4124; Component = Unknown; Operation = Start IWbemServices::ExecMethod - root\microsoft\windows\servermanager : MSFT_ServerManagerTasks::GetServerFeature; ResultCode = 0x80041032; PossibleCause = Unknown	5858	2	4611686018427387904	454	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	432	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:32 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4608; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll	5857	0	4611686018427387904	453	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	4608	4636	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:30 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
nettcpip provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2872; ProviderPath = %systemroot%\system32\wbem\NetTCPIP.dll	5857	0	4611686018427387904	452	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2872	2896	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 9:27:26 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NetAdapterCim provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4344; ProviderPath = %systemroot%\system32\wbem\NetAdapterCim.dll	5857	0	4611686018427387904	451	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	4344	4368	WIN-5T344G8GM1H	S-1-5-19	1/19/2018 9:27:26 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2872; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll	5857	0	4611686018427387904	450	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2872	2900	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 9:27:25 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
MSVDS__PROVIDER provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2872; ProviderPath = %systemroot%\system32\wbem\vdswmi.dll	5857	0	4611686018427387904	449	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2872	2900	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 9:27:20 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32a provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2872; ProviderPath = %systemroot%\system32\wbem\wmipcima.dll	5857	0	4611686018427387904	448	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2872	2900	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 9:27:19 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Namespace = //./root/CIMV2; NotificationQuery = select * from MSFT_SCMEventLogEvent; OwnerName = S-1-5-32-544; HostProcessID = 956; Provider= SCM Event Provider, queryID = 0; PossibleCause = Permanent	5859	0	4611686018427387904	447	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2284	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:18 AM	aff0bd57-9107-0002-9bbd-f0af0791d301	microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Namespace = root\virtualization\v2; NotificationQuery = SELECT * FROM __ClassOperationEvent; UserName = .\SYSTEM; ClientProcessID = 0, ClientMachine = ; PossibleCause = Temporary	5860	0	4611686018427387904	446	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:18 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Namespace = //./root/subscription; Eventfilter = SCM Event Log Filter (refer to its activate eventid:5859); Consumer = NTEventLogEventConsumer="SCM Event Log Consumer"; PossibleCause = Binding EventFilter: instance of __EventFilter { CreatorSID = {1, 2, 0, 0, 0, 0, 0, 5, 32, 0, 0, 0, 32, 2, 0, 0}; EventNamespace = "root\\cimv2"; Name = "SCM Event Log Filter"; Query = "select * from MSFT_SCMEventLogEvent"; QueryLanguage = "WQL"; }; Perm. Consumer: instance of NTEventLogEventConsumer { Category = 0; CreatorSID = {1, 2, 0, 0, 0, 0, 0, 5, 32, 0, 0, 0, 32, 2, 0, 0}; EventType = 1; Name = "SCM Event Log Consumer"; NameOfUserSIDProperty = "sid"; SourceName = "Service Control Manager"; };	5861	0	4611686018427387904	445	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2284	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:18 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{FC491EF1-C4AA-4CE1-B329-414B101DB823}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	444	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{fbf687e6-f063-4d9f-9f4f-fd9a26acdd5f}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	443	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{FB2CA36D-0B40-4307-821B-A13B252DE56C}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	442	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{f3ccc681-b74c-4060-9f26-cd84525dca2a}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	441	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{F312195E-3D9D-447A-A3F5-08DFFA24735E}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	440	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{E62688F0-25FD-4c90-BFF5-F508B9D2E31F}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	439	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{E5094040-C46C-4115-B030-04FB2E545B00}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	438	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{E4F48E54-F38D-4884-BFB9-D4D2E5729C18}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	437	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{e437bc1c-aa7d-11d2-a382-00c04f991e27}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	436	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{CF7639F3-ABA2-41DB-97F2-81E2C5DBFC5D}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	435	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{cdeafc3d-948d-49dd-ab12-e578ba4af7aa}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	434	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{c6dc5466-785a-11d2-84d0-00c04fb169f7}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	433	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{C631DF4C-088F-4156-B058-4375F0853CD8}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	432	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{C418DD9D-0D14-4efb-8FBF-CFE535C8FAC7}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	431	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{C34B2751-1CF4-44F5-9262-C3FC39666591}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	430	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{BC75B1ED-5833-4858-9BB8-CBF0B166DF9D}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	429	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{BA649533-0AAC-4E04-B9BC-4DBAE0325B12}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	428	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{B587E2B1-4D59-4e7e-AED9-22B9DF11D053}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	427	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{B087BE9D-ED37-454f-AF9C-04291E351182}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	426	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{AADCED64-746C-4633-A97C-D61349046527}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	425	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{A3F3E39B-5D83-4940-B954-28315B82F0A8}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	424	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{91FBB303-0CD5-4055-BF42-E512A681B325}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	423	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{8A28E2C5-8D06-49A4-A08C-632DAA493E17}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	422	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{827D319E-6EAC-11D2-A4EA-00C04F79F83A}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	421	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{7B849a69-220F-451E-B3FE-2CB811AF94AE}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	420	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2864	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{7933F41E-56F8-41d6-A31C-4148A711EE93}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	419	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2864	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{74EE6C03-5363-4554-B161-627540339CAB}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	418	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2864	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{728EE579-943C-4519-9EF7-AB56765798ED}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	417	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2864	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{7150F9BF-48AD-4da4-A49C-29EF4A8369BA}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	416	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2864	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{6A4C88C6-C502-4f74-8F60-2CB23EDC24E2}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	415	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2864	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{6232C319-91AC-4931-9385-E70C2B099F0E}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	414	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2864	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{4CFB60C1-FAA6-47f1-89AA-0B18730C9FD3}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	413	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2868	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{4bcd6cde-777b-48b6-9804-43568e23545d}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	412	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{4B7C3B0F-E993-4E06-A241-3FBE06943684}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	411	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{42B5FAAE-6536-11d2-AE5A-0000F87571E3}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	410	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2864	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{426031c0-0b47-4852-b0ca-ac3d37bfcb39}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	409	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2864	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{3A0DBA37-F8B2-4356-83DE-3E90BD5C261F}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	408	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2864	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{3610eda5-77ef-11d2-8dc5-00c04fa31a66}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	407	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2864	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{2BFCC077-22D2-48DE-BDE1-2F618D9B476D}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	406	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2864	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{2A8FDC61-2347-4C87-92F6-B05EB91A201A}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	405	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2868	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{1A6364EB-776B-4120-ADE1-B63A406A76B5}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	404	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2864	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{17D89FEC-5C44-4972-B12D-241CAEF74509}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	403	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2864	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{16be69fa-4209-4250-88cb-716cf41954e0}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	402	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2864	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{169EBF44-942F-4C43-87CE-13C93996EBBE}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	401	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{0E28E245-9368-4853-AD84-6DA3BA35BB75}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	400	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{0ACDD40C-75AC-47ab-BAA0-BF6DE7E7FE63}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	399	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{FC491EF1-C4AA-4CE1-B329-414B101DB823}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	398	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{fbf687e6-f063-4d9f-9f4f-fd9a26acdd5f}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	397	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{FB2CA36D-0B40-4307-821B-A13B252DE56C}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	396	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{f3ccc681-b74c-4060-9f26-cd84525dca2a}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	395	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{F312195E-3D9D-447A-A3F5-08DFFA24735E}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	394	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{E62688F0-25FD-4c90-BFF5-F508B9D2E31F}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	393	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{E5094040-C46C-4115-B030-04FB2E545B00}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	392	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{E4F48E54-F38D-4884-BFB9-D4D2E5729C18}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	391	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{e437bc1c-aa7d-11d2-a382-00c04f991e27}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	390	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{CF7639F3-ABA2-41DB-97F2-81E2C5DBFC5D}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	389	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{cdeafc3d-948d-49dd-ab12-e578ba4af7aa}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	388	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{c6dc5466-785a-11d2-84d0-00c04fb169f7}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	387	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{C631DF4C-088F-4156-B058-4375F0853CD8}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	386	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{C418DD9D-0D14-4efb-8FBF-CFE535C8FAC7}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	385	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{C34B2751-1CF4-44F5-9262-C3FC39666591}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	384	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{BC75B1ED-5833-4858-9BB8-CBF0B166DF9D}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	383	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{BA649533-0AAC-4E04-B9BC-4DBAE0325B12}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	382	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{B587E2B1-4D59-4e7e-AED9-22B9DF11D053}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	381	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{B087BE9D-ED37-454f-AF9C-04291E351182}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	380	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{AADCED64-746C-4633-A97C-D61349046527}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	379	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{A3F3E39B-5D83-4940-B954-28315B82F0A8}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	378	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{91FBB303-0CD5-4055-BF42-E512A681B325}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	377	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{8A28E2C5-8D06-49A4-A08C-632DAA493E17}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	376	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{827D319E-6EAC-11D2-A4EA-00C04F79F83A}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	375	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{7B849a69-220F-451E-B3FE-2CB811AF94AE}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	374	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{7933F41E-56F8-41d6-A31C-4148A711EE93}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	373	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{74EE6C03-5363-4554-B161-627540339CAB}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	372	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{728EE579-943C-4519-9EF7-AB56765798ED}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	371	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{7150F9BF-48AD-4da4-A49C-29EF4A8369BA}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	370	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{6A4C88C6-C502-4f74-8F60-2CB23EDC24E2}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	369	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{6232C319-91AC-4931-9385-E70C2B099F0E}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	368	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{4CFB60C1-FAA6-47f1-89AA-0B18730C9FD3}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	367	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{4bcd6cde-777b-48b6-9804-43568e23545d}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	366	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{4B7C3B0F-E993-4E06-A241-3FBE06943684}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	365	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{42B5FAAE-6536-11d2-AE5A-0000F87571E3}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	364	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{426031c0-0b47-4852-b0ca-ac3d37bfcb39}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	363	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{3A0DBA37-F8B2-4356-83DE-3E90BD5C261F}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	362	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{3610eda5-77ef-11d2-8dc5-00c04fa31a66}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	361	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{2BFCC077-22D2-48DE-BDE1-2F618D9B476D}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	360	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{2A8FDC61-2347-4C87-92F6-B05EB91A201A}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	359	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{1A6364EB-776B-4120-ADE1-B63A406A76B5}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	358	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{17D89FEC-5C44-4972-B12D-241CAEF74509}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	357	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{16be69fa-4209-4250-88cb-716cf41954e0}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	356	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{169EBF44-942F-4C43-87CE-13C93996EBBE}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	355	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{0E28E245-9368-4853-AD84-6DA3BA35BB75}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	354	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{0ACDD40C-75AC-47ab-BAA0-BF6DE7E7FE63}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	353	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2872; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll	5857	0	4611686018427387904	352	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2872	2900	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 2336; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\virtualization\v2 : Msvm_ResourcePoolComponent.Name="Microsoft\|RDV Integration Component Resource Pool\|V2.0"; ResultCode = 0x80041010; PossibleCause = Unknown	5858	2	4611686018427387904	351	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2864	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Namespace = ROOT\virtualization\v2; NotificationQuery = SELECT * FROM __ClassOperationEvent; UserName = .\SYSTEM; ClientProcessID = 0, ClientMachine = ; PossibleCause = Temporary	5860	0	4611686018427387904	350	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	968	2820	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:26:58 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 2360; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\virtualization\v2 : Msvm_ResourcePoolComponent.Name="Microsoft\|RDV Integration Component Resource Pool\|V2.0"; ResultCode = 0x80041010; PossibleCause = Unknown	5858	2	4611686018427387904	349	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	968	2820	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:26:52 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\HyperVCluster\v2 : Msvm_VirtualHardDiskState; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	348	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	968	2820	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:26:51 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\HyperVCluster\v2 : Msvm_VirtualHardDiskSettingData; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	347	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	968	2820	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:26:51 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\HyperVCluster\v2 : Msvm_VirtualHardDiskInfo; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	346	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	968	2820	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:26:51 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\HyperVCluster\v2 : Msvm_ServicingSettings; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	345	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	968	2820	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:26:51 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\HyperVCluster\v2 : CIM_SettingsDefineState; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	344	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	968	2820	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:26:51 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\HyperVCluster\v2 : CIM_ServiceAffectsElement; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	343	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	968	2820	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:26:51 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\HyperVCluster\v2 : CIM_ManagedElement; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	342	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	968	2820	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:26:51 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\HyperVCluster\v2 : CIM_ElementSettingData; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	341	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	968	2820	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:26:51 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\HyperVCluster\v2 : CIM_ElementCapabilities; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	340	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	968	2820	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:26:51 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\HyperVCluster\v2 : CIM_Dependency; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	339	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	968	2820	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:26:51 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\HyperVCluster\v2 : CIM_Component; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	338	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	968	2820	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:26:51 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\HyperVCluster\v2 : CIM_AffectedJobElement; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	337	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	968	2820	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:26:51 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\HyperVCluster\v2\ms_409 : Msvm_SummaryInformationBase; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	336	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	968	2820	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:26:51 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\HyperVCluster\v2\ms_409 : CIM_SettingsDefineState; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	335	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	968	2820	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:26:51 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\HyperVCluster\v2\ms_409 : CIM_ServiceAffectsElement; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	334	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	968	2824	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:26:51 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\HyperVCluster\v2\ms_409 : CIM_ManagedElement; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	333	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	968	2820	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:26:51 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\HyperVCluster\v2\ms_409 : CIM_ElementSettingData; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	332	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	968	2820	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:26:51 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\HyperVCluster\v2\ms_409 : CIM_ElementCapabilities; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	331	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	968	2820	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:26:51 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\HyperVCluster\v2\ms_409 : CIM_Dependency; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	330	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	968	2820	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:26:51 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\HyperVCluster\v2\ms_409 : CIM_Component; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	329	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	968	2820	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:26:51 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\HyperVCluster\v2\ms_409 : CIM_AffectedJobElement; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	328	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	968	2820	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:26:51 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Namespace = //./root/CIMV2; NotificationQuery = select * from MSFT_SCMEventLogEvent; OwnerName = S-1-5-32-544; HostProcessID = 968; Provider= SCM Event Provider, queryID = 0; PossibleCause = Permanent	5859	0	4611686018427387904	327	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	968	2948	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:26:51 AM	96ed06e7-9107-0000-3d07-ed960791d301	microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Namespace = //./root/subscription; Eventfilter = SCM Event Log Filter (refer to its activate eventid:5859); Consumer = NTEventLogEventConsumer="SCM Event Log Consumer"; PossibleCause = Binding EventFilter: instance of __EventFilter { CreatorSID = {1, 2, 0, 0, 0, 0, 0, 5, 32, 0, 0, 0, 32, 2, 0, 0}; EventNamespace = "root\\cimv2"; Name = "SCM Event Log Filter"; Query = "select * from MSFT_SCMEventLogEvent"; QueryLanguage = "WQL"; }; Perm. Consumer: instance of NTEventLogEventConsumer { Category = 0; CreatorSID = {1, 2, 0, 0, 0, 0, 0, 5, 32, 0, 0, 0, 32, 2, 0, 0}; EventType = 1; Name = "SCM Event Log Consumer"; NameOfUserSIDProperty = "sid"; SourceName = "Service Control Manager"; };	5861	0	4611686018427387904	326	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	968	2948	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:26:51 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2 : Msvm_VirtualDiskChangedRange; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	325	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	968	2820	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:26:50 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2 : Msvm_VHDSSnapshotInformation; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	324	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	968	2820	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:26:50 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2 : Msvm_VHDSetInformation; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	323	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	968	2820	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:26:50 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2 : Msvm_VirtualHardDiskSettingData; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	322	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	968	2820	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:26:50 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2 : Msvm_VirtualHardDiskInfo; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	321	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	968	2820	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:26:50 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2 : Msvm_SummaryInformationBase; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	320	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	968	2820	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:26:50 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2 : Msvm_ServicingSettings; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	319	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	968	2820	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:26:50 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2 : CIM_SettingsDefineState; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	318	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	968	2820	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:26:50 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2 : CIM_ServiceAffectsElement; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	317	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	968	2820	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:26:50 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2 : CIM_ManagedElement; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	316	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	968	2820	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:26:50 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2 : CIM_ElementSettingData; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	315	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	968	2820	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:26:50 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2 : CIM_ElementCapabilities; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	314	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	968	2820	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:26:50 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2 : CIM_Dependency; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	313	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	968	2820	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:26:50 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2 : CIM_Component; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	312	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	968	2820	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:26:50 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2 : CIM_AffectedJobElement; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	311	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	968	2820	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:26:50 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2\ms_409 : Msvm_VirtualDiskChangedRange; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	310	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	968	2820	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:26:49 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2\ms_409 : Msvm_VHDSSnapshotInformation; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	309	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	968	2820	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:26:49 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2\ms_409 : Msvm_VHDSetInformation; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	308	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	968	2820	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:26:49 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2\ms_409 : Msvm_VirtualHardDiskSettingData; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	307	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	968	2820	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:26:49 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2\ms_409 : Msvm_VirtualHardDiskInfo; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	306	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	968	2820	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:26:49 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2\ms_409 : Msvm_SummaryInformationBase; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	305	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	968	2820	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:26:49 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2\ms_409 : Msvm_ServicingSettings; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	304	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	968	2820	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:26:49 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2\ms_409 : CIM_SettingsDefineState; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	303	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	968	2820	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:26:49 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2\ms_409 : CIM_ServiceAffectsElement; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	302	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	968	2820	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:26:49 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2\ms_409 : CIM_ManagedElement; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	301	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	968	2820	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:26:49 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2\ms_409 : CIM_ElementSettingData; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	300	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	968	2820	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:26:49 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2\ms_409 : CIM_ElementCapabilities; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	299	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	968	2820	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:26:49 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2\ms_409 : CIM_Dependency; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	298	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	968	2820	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:26:49 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2\ms_409 : CIM_Component; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	297	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	968	2820	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:26:49 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2\ms_409 : CIM_AffectedJobElement; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	296	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	968	2820	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:26:49 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
MSVDS__PROVIDER provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2840; ProviderPath = %systemroot%\system32\wbem\vdswmi.dll	5857	0	4611686018427387904	295	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2840	2880	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 9:26:46 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32a provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2840; ProviderPath = %systemroot%\system32\wbem\wmipcima.dll	5857	0	4611686018427387904	294	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2840	2880	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 9:26:44 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2840; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll	5857	0	4611686018427387904	293	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2840	2864	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 9:26:42 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 308; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_ComputerSystem; ResultCode = 0x80041032; PossibleCause = Unknown	5858	2	4611686018427387904	292	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2620	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:25:03 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 308; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_ComputerSystem; ResultCode = 0x80041032; PossibleCause = Unknown	5858	2	4611686018427387904	291	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	404	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:25:02 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2528; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll	5857	0	4611686018427387904	290	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2528	3456	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:24:56 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
nettcpip provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2508; ProviderPath = %systemroot%\system32\wbem\NetTCPIP.dll	5857	0	4611686018427387904	289	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2508	4092	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 9:24:53 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NetAdapterCim provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2736; ProviderPath = %systemroot%\system32\wbem\NetAdapterCim.dll	5857	0	4611686018427387904	288	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2736	3804	WIN-5T344G8GM1H	S-1-5-19	1/19/2018 9:24:53 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2508; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll	5857	0	4611686018427387904	287	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2508	4092	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 9:24:53 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2508; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll	5857	0	4611686018427387904	286	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2508	2824	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 9:24:53 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3200; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll	5857	0	4611686018427387904	285	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	3200	3644	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:23:15 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
nettcpip provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2856; ProviderPath = %systemroot%\system32\wbem\NetTCPIP.dll	5857	0	4611686018427387904	284	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2856	2920	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 9:23:12 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NetAdapterCim provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2540; ProviderPath = %systemroot%\system32\wbem\NetAdapterCim.dll	5857	0	4611686018427387904	283	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2540	3240	WIN-5T344G8GM1H	S-1-5-19	1/19/2018 9:23:12 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2856; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll	5857	0	4611686018427387904	282	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2856	2884	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 9:23:11 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
MSVDS__PROVIDER provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2856; ProviderPath = %systemroot%\system32\wbem\vdswmi.dll	5857	0	4611686018427387904	281	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2856	2884	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 9:23:05 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32a provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2856; ProviderPath = %systemroot%\system32\wbem\wmipcima.dll	5857	0	4611686018427387904	280	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2856	2884	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 9:23:04 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Namespace = //./root/CIMV2; NotificationQuery = select * from MSFT_SCMEventLogEvent; OwnerName = S-1-5-32-544; HostProcessID = 956; Provider= SCM Event Provider, queryID = 0; PossibleCause = Permanent	5859	0	4611686018427387904	279	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2916	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:23:03 AM	17f2f0cc-9107-0002-12f1-f2170791d301	microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Namespace = //./root/subscription; Eventfilter = SCM Event Log Filter (refer to its activate eventid:5859); Consumer = NTEventLogEventConsumer="SCM Event Log Consumer"; PossibleCause = Binding EventFilter: instance of __EventFilter { CreatorSID = {1, 2, 0, 0, 0, 0, 0, 5, 32, 0, 0, 0, 32, 2, 0, 0}; EventNamespace = "root\\cimv2"; Name = "SCM Event Log Filter"; Query = "select * from MSFT_SCMEventLogEvent"; QueryLanguage = "WQL"; }; Perm. Consumer: instance of NTEventLogEventConsumer { Category = 0; CreatorSID = {1, 2, 0, 0, 0, 0, 0, 5, 32, 0, 0, 0, 32, 2, 0, 0}; EventType = 1; Name = "SCM Event Log Consumer"; NameOfUserSIDProperty = "sid"; SourceName = "Service Control Manager"; };	5861	0	4611686018427387904	278	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2908	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:23:03 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2856; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll	5857	0	4611686018427387904	277	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2856	2884	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 9:23:02 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3808; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll	5857	0	4611686018427387904	276	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	3808	4032	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:14:59 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
nettcpip provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2664; ProviderPath = %systemroot%\system32\wbem\NetTCPIP.dll	5857	0	4611686018427387904	275	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2664	2720	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 9:14:58 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NetAdapterCim provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2972; ProviderPath = %systemroot%\system32\wbem\NetAdapterCim.dll	5857	0	4611686018427387904	274	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2972	156	WIN-5T344G8GM1H	S-1-5-19	1/19/2018 9:14:58 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2664; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll	5857	0	4611686018427387904	273	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2664	2720	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 9:14:57 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2664; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll	5857	0	4611686018427387904	272	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2664	1584	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 9:14:57 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = WIN-5T344G8GM1H\Administrator; ClientProcessId = 1860; Component = Unknown; Operation = Start IWbemServices::PutInstance - root\cimv2 : Win32_ComputerSystem.Name="WIN-5T344G8GM1H"; ResultCode = 0x80041001; PossibleCause = Unknown	5858	2	4611686018427387904	271	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	1180	4136	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:11:39 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4368; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll	5857	0	4611686018427387904	270	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	4368	4496	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 9:10:55 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1784; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll	5857	0	4611686018427387904	269	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	1784	2240	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:05:00 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
nettcpip provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 952; ProviderPath = %systemroot%\system32\wbem\NetTCPIP.dll	5857	0	4611686018427387904	268	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	952	452	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 9:04:58 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NetAdapterCim provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1152; ProviderPath = %systemroot%\system32\wbem\NetAdapterCim.dll	5857	0	4611686018427387904	267	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	1152	1396	WIN-5T344G8GM1H	S-1-5-19	1/19/2018 9:04:58 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 952; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll	5857	0	4611686018427387904	266	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	952	452	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 9:04:57 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 952; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll	5857	0	4611686018427387904	265	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	952	1000	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 9:04:57 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WMIProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3176; ProviderPath = %systemroot%\system32\wbem\wmiprov.dll	5857	0	4611686018427387904	264	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	3176	3364	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:58:49 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
MSVDS__PROVIDER provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4672; ProviderPath = %systemroot%\system32\wbem\vdswmi.dll	5857	0	4611686018427387904	263	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	4672	4700	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 8:57:50 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4672; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll	5857	0	4611686018427387904	262	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	4672	4700	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 8:57:50 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 88; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_ComputerSystemProduct; ResultCode = 0x80041032; PossibleCause = Unknown	5858	2	4611686018427387904	261	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	1180	1284	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:56:50 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4672; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll	5857	0	4611686018427387904	260	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	4672	4700	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 8:56:50 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Namespace = //./root/CIMV2; NotificationQuery = select * from MSFT_SCMEventLogEvent; OwnerName = S-1-5-32-544; HostProcessID = 1180; Provider= SCM Event Provider, queryID = 0; PossibleCause = Permanent	5859	0	4611686018427387904	259	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	1180	4340	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:56:46 AM	289cfce6-9103-0003-f9fd-9c280391d301	microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Namespace = //./root/subscription; Eventfilter = SCM Event Log Filter (refer to its activate eventid:5859); Consumer = NTEventLogEventConsumer="SCM Event Log Consumer"; PossibleCause = Binding EventFilter: instance of __EventFilter { CreatorSID = {1, 2, 0, 0, 0, 0, 0, 5, 32, 0, 0, 0, 32, 2, 0, 0}; EventNamespace = "root\\cimv2"; Name = "SCM Event Log Filter"; Query = "select * from MSFT_SCMEventLogEvent"; QueryLanguage = "WQL"; }; Perm. Consumer: instance of NTEventLogEventConsumer { Category = 0; CreatorSID = {1, 2, 0, 0, 0, 0, 0, 5, 32, 0, 0, 0, 32, 2, 0, 0}; EventType = 1; Name = "SCM Event Log Consumer"; NameOfUserSIDProperty = "sid"; SourceName = "Service Control Manager"; };	5861	0	4611686018427387904	258	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	1180	4340	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:56:46 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
MSVDS__PROVIDER provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3968; ProviderPath = %systemroot%\system32\wbem\vdswmi.dll	5857	0	4611686018427387904	257	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	3968	4008	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 8:55:06 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32a provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3968; ProviderPath = %systemroot%\system32\wbem\wmipcima.dll	5857	0	4611686018427387904	256	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	3968	4008	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 8:55:05 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3688; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll	5857	0	4611686018427387904	255	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	3688	3696	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:55:04 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
nettcpip provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3968; ProviderPath = %systemroot%\system32\wbem\NetTCPIP.dll	5857	0	4611686018427387904	254	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	3968	4020	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 8:54:58 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NetAdapterCim provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4024; ProviderPath = %systemroot%\system32\wbem\NetAdapterCim.dll	5857	0	4611686018427387904	253	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	4024	4052	WIN-5T344G8GM1H	S-1-5-19	1/19/2018 8:54:58 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3968; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll	5857	0	4611686018427387904	252	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	3968	4008	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 8:54:58 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3968; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll	5857	0	4611686018427387904	251	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	3968	3996	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 8:54:58 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3880; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll	5857	0	4611686018427387904	250	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	3880	3916	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 8:54:38 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {7C5C4FFB-9102-0000-4A51-5C7C0291D301}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 1192; Component = Unknown; Operation = Start IWbemServices::ExecNotificationQuery - ROOT\CIMV2 : SELECT * FROM Win32_ProcessStartTrace WHERE ProcessName = 'wsmprovhost.exe'; ResultCode = 0x80041032; PossibleCause = Unknown	5858	2	4611686018427387904	249	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	1192	3004	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:54:34 AM	7c5c4ffb-9102-0000-4a51-5c7c0291d301	microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WMIProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1200; ProviderPath = %systemroot%\system32\wbem\wmiprov.dll	5857	0	4611686018427387904	248	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	1200	2840	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:54:03 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Namespace = ROOT\CIMV2; NotificationQuery = SELECT * FROM Win32_ProcessStartTrace WHERE ProcessName = 'wsmprovhost.exe'; UserName = ; ClientProcessID = 1192, ClientMachine = WIN-5T344G8GM1H; PossibleCause = Temporary	5860	0	4611686018427387904	247	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	1192	2792	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:52:27 AM	7c5c4ffb-9102-0001-8851-5c7c0291d301	microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WMI Kernel Trace Event Provider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1192; ProviderPath = C:\Windows\System32\wbem\krnlprov.dll	5857	0	4611686018427387904	246	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	1192	2792	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:52:27 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Namespace = //./root/CIMV2; NotificationQuery = select * from MSFT_SCMEventLogEvent; OwnerName = S-1-5-32-544; HostProcessID = 1192; Provider= SCM Event Provider, queryID = 0; PossibleCause = Permanent	5859	0	4611686018427387904	245	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	1192	2796	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:51:57 AM	7c5c4ffb-9102-0001-5f51-5c7c0291d301	microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Namespace = //./root/subscription; Eventfilter = SCM Event Log Filter (refer to its activate eventid:5859); Consumer = NTEventLogEventConsumer="SCM Event Log Consumer"; PossibleCause = Binding EventFilter: instance of __EventFilter { CreatorSID = {1, 2, 0, 0, 0, 0, 0, 5, 32, 0, 0, 0, 32, 2, 0, 0}; EventNamespace = "root\\cimv2"; Name = "SCM Event Log Filter"; Query = "select * from MSFT_SCMEventLogEvent"; QueryLanguage = "WQL"; }; Perm. Consumer: instance of NTEventLogEventConsumer { Category = 0; CreatorSID = {1, 2, 0, 0, 0, 0, 0, 5, 32, 0, 0, 0, 32, 2, 0, 0}; EventType = 1; Name = "SCM Event Log Consumer"; NameOfUserSIDProperty = "sid"; SourceName = "Service Control Manager"; };	5861	0	4611686018427387904	244	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	1192	2796	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:51:57 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
MSVDS__PROVIDER provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3832; ProviderPath = %systemroot%\system32\wbem\vdswmi.dll	5857	0	4611686018427387904	243	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	3832	3932	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 8:51:38 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32a provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3832; ProviderPath = %systemroot%\system32\wbem\wmipcima.dll	5857	0	4611686018427387904	242	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	3832	3872	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 8:51:37 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 428; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll	5857	0	4611686018427387904	241	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	428	1316	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:51:13 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
nettcpip provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3832; ProviderPath = %systemroot%\system32\wbem\NetTCPIP.dll	5857	0	4611686018427387904	240	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	3832	3872	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 8:51:04 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NetAdapterCim provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3888; ProviderPath = %systemroot%\system32\wbem\NetAdapterCim.dll	5857	0	4611686018427387904	239	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	3888	3916	WIN-5T344G8GM1H	S-1-5-19	1/19/2018 8:51:04 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3832; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll	5857	0	4611686018427387904	238	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	3832	3872	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 8:51:04 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3832; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll	5857	0	4611686018427387904	237	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	3832	3860	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 8:51:04 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4796; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll	5857	0	4611686018427387904	236	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	4796	840	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 8:45:55 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2284; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll	5857	0	4611686018427387904	235	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2284	2676	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:44:15 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
nettcpip provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2548; ProviderPath = %systemroot%\system32\wbem\NetTCPIP.dll	5857	0	4611686018427387904	234	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2548	2728	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 8:44:08 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NetAdapterCim provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2300; ProviderPath = %systemroot%\system32\wbem\NetAdapterCim.dll	5857	0	4611686018427387904	233	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2300	4360	WIN-5T344G8GM1H	S-1-5-19	1/19/2018 8:44:08 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2548; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll	5857	0	4611686018427387904	232	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2548	2728	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 8:44:08 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2548; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll	5857	0	4611686018427387904	231	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2548	3736	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 8:44:08 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1052; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll	5857	0	4611686018427387904	230	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	1052	4868	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 8:36:56 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3184; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll	5857	0	4611686018427387904	229	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	3184	404	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:34:15 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Win32_WIN32_TERMINALSERVICE_Prov provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1164; ProviderPath = %SystemRoot%\system32\tscfgwmi.dll	5857	0	4611686018427387904	228	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	1164	4616	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 8:34:14 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4600; Component = Unknown; Operation = Start IWbemServices::ExecQuery - ROOT\WMI : SELECT * FROM BatteryStaticData; ResultCode = 0x80041010; PossibleCause = Unknown	5858	2	4611686018427387904	227	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	964	4904	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:34:14 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4600; Component = Unknown; Operation = Start IWbemServices::ExecQuery - ROOT\WMI : SELECT * FROM BatteryFullChargedCapacity; ResultCode = 0x80041010; PossibleCause = Unknown	5858	2	4611686018427387904	226	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	964	4904	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:34:13 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
PowerWmiProvider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1164; ProviderPath = %SYSTEMROOT%\system32\PowerWmiProvider.dll	5857	0	4611686018427387904	225	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	1164	1368	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 8:34:13 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
StorageWMI provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1164; ProviderPath = %SystemRoot%\System32\storagewmi.dll	5857	0	4611686018427387904	224	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	1164	1368	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 8:34:11 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
MSVDS__PROVIDER provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1164; ProviderPath = %systemroot%\system32\wbem\vdswmi.dll	5857	0	4611686018427387904	223	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	1164	1368	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 8:34:11 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
nettcpip provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1164; ProviderPath = %systemroot%\system32\wbem\NetTCPIP.dll	5857	0	4611686018427387904	222	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	1164	1368	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 8:34:08 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NetAdapterCim provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2920; ProviderPath = %systemroot%\system32\wbem\NetAdapterCim.dll	5857	0	4611686018427387904	221	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2920	4532	WIN-5T344G8GM1H	S-1-5-19	1/19/2018 8:34:08 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1164; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll	5857	0	4611686018427387904	220	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	1164	1368	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 8:34:08 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1164; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll	5857	0	4611686018427387904	219	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	1164	1532	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 8:34:08 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9A81CB05-910F-0003-8ACC-819A0F91D301}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 964; Component = Unknown; Operation = Start IWbemServices::ExecNotificationQuery - ROOT\CIMV2 : SELECT * FROM Win32_ProcessStartTrace WHERE ProcessName = 'wsmprovhost.exe'; ResultCode = 0x80041032; PossibleCause = Unknown	5858	2	4611686018427387904	218	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	964	4228	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:33:15 AM	9a81cb05-910f-0003-8acc-819a0f91d301	microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3976; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\Microsoft\Windows\DeviceGuard : SELECT RequiredSecurityProperties FROM Win32_DeviceGuard ; ResultCode = 0x80041032; PossibleCause = Unknown	5858	2	4611686018427387904	217	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	964	1824	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:33:01 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3976; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\Microsoft\Windows\DeviceGuard : SELECT SecurityServicesConfigured FROM Win32_DeviceGuard ; ResultCode = 0x80041032; PossibleCause = Unknown	5858	2	4611686018427387904	216	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	964	5076	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:33:01 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Win32_TpmProvider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1164; ProviderPath = C:\Windows\system32\wbem\Win32_TPM.dll	5857	0	4611686018427387904	215	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	1164	1532	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 8:33:01 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3976; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\Microsoft\Windows\DeviceGuard : SELECT VirtualizationBasedSecurityStatus FROM Win32_DeviceGuard ; ResultCode = 0x80041032; PossibleCause = Unknown	5858	2	4611686018427387904	214	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	964	5076	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:33:01 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3976; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\Microsoft\Windows\DeviceGuard : SELECT SecurityServicesRunning FROM Win32_DeviceGuard ; ResultCode = 0x80041032; PossibleCause = Unknown	5858	2	4611686018427387904	213	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	964	5076	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:33:01 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3976; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\Microsoft\Windows\DeviceGuard : SELECT AvailableSecurityProperties FROM Win32_DeviceGuard ; ResultCode = 0x80041032; PossibleCause = Unknown	5858	2	4611686018427387904	212	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	964	1824	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:33:01 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3976; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\Microsoft\Windows\DeviceGuard : SELECT RequiredSecurityProperties FROM Win32_DeviceGuard ; ResultCode = 0x80041032; PossibleCause = Unknown	5858	2	4611686018427387904	211	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	964	5076	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:33:01 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Win32_DeviceGuard provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1164; ProviderPath = %SystemRoot%\System32\Win32_DeviceGuard.dll	5857	0	4611686018427387904	210	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	1164	1532	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 8:33:01 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3976; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\CIMV2 : SELECT SMBIOSAssetTag FROM Win32_SystemEnclosure ; ResultCode = 0x80041032; PossibleCause = Unknown	5858	2	4611686018427387904	209	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	964	5076	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:32:59 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
MSVDS__PROVIDER provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1164; ProviderPath = %systemroot%\system32\wbem\vdswmi.dll	5857	0	4611686018427387904	208	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	1164	1532	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 8:32:59 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1164; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll	5857	0	4611686018427387904	207	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	1164	2868	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 8:32:58 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1912; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll	5857	0	4611686018427387904	206	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	1912	3084	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:32:58 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
ServerFeatureProvider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1164; ProviderPath = %windir%\system32\wbem\servercompprov.dll	5857	0	4611686018427387904	205	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	1164	1532	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 8:32:58 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
MSVDS__PROVIDER provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 996; ProviderPath = %systemroot%\system32\wbem\vdswmi.dll	5857	0	4611686018427387904	204	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	996	456	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 8:29:00 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 996; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll	5857	0	4611686018427387904	203	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	996	456	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 8:29:00 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WMIProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4324; ProviderPath = %systemroot%\system32\wbem\wmiprov.dll	5857	0	4611686018427387904	202	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	4324	3568	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:27:56 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Namespace = ROOT\CIMV2; NotificationQuery = SELECT * FROM Win32_ProcessStartTrace WHERE ProcessName = 'wsmprovhost.exe'; UserName = ; ClientProcessID = 964, ClientMachine = WIN-5T344G8GM1H; PossibleCause = Temporary	5860	0	4611686018427387904	201	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	964	3260	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:26:55 AM	9a81cb05-910f-0000-a4cc-819a0f91d301	microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WMI Kernel Trace Event Provider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 964; ProviderPath = C:\Windows\System32\wbem\krnlprov.dll	5857	0	4611686018427387904	200	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	964	3260	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:26:55 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
MSVDS__PROVIDER provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3772; ProviderPath = %systemroot%\system32\wbem\vdswmi.dll	5857	0	4611686018427387904	199	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	3772	3768	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 8:26:50 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3772; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll	5857	0	4611686018427387904	198	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	3772	3768	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 8:25:57 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Namespace = //./root/CIMV2; NotificationQuery = select * from MSFT_SCMEventLogEvent; OwnerName = S-1-5-32-544; HostProcessID = 964; Provider= SCM Event Provider, queryID = 0; PossibleCause = Permanent	5859	0	4611686018427387904	197	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	964	4648	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:25:52 AM	9a81cb05-910f-0003-4bcc-819a0f91d301	microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Namespace = //./root/subscription; Eventfilter = SCM Event Log Filter (refer to its activate eventid:5859); Consumer = NTEventLogEventConsumer="SCM Event Log Consumer"; PossibleCause = Binding EventFilter: instance of __EventFilter { CreatorSID = {1, 2, 0, 0, 0, 0, 0, 5, 32, 0, 0, 0, 32, 2, 0, 0}; EventNamespace = "root\\cimv2"; Name = "SCM Event Log Filter"; Query = "select * from MSFT_SCMEventLogEvent"; QueryLanguage = "WQL"; }; Perm. Consumer: instance of NTEventLogEventConsumer { Category = 0; CreatorSID = {1, 2, 0, 0, 0, 0, 0, 5, 32, 0, 0, 0, 32, 2, 0, 0}; EventType = 1; Name = "SCM Event Log Consumer"; NameOfUserSIDProperty = "sid"; SourceName = "Service Control Manager"; };	5861	0	4611686018427387904	196	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	964	4648	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:25:52 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
MSVDS__PROVIDER provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3772; ProviderPath = %systemroot%\system32\wbem\vdswmi.dll	5857	0	4611686018427387904	195	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	3772	3768	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 8:24:46 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4124; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll	5857	0	4611686018427387904	194	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	4124	4152	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:24:15 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
nettcpip provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3772; ProviderPath = %systemroot%\system32\wbem\NetTCPIP.dll	5857	0	4611686018427387904	193	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	3772	3820	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 8:24:08 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NetAdapterCim provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3084; ProviderPath = %systemroot%\system32\wbem\NetAdapterCim.dll	5857	0	4611686018427387904	192	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	3084	3436	WIN-5T344G8GM1H	S-1-5-19	1/19/2018 8:24:08 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3772; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll	5857	0	4611686018427387904	191	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	3772	3800	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 8:24:08 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32a provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3772; ProviderPath = %systemroot%\system32\wbem\wmipcima.dll	5857	0	4611686018427387904	190	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	3772	3800	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 8:24:03 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3772; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll	5857	0	4611686018427387904	189	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	3772	3800	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 8:24:03 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3868; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll	5857	0	4611686018427387904	188	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	3868	3176	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 6:37:16 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
nettcpip provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2504; ProviderPath = %systemroot%\system32\wbem\NetTCPIP.dll	5857	0	4611686018427387904	187	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2504	2192	WIN-5T344G8GM1H	S-1-5-20	1/16/2018 6:37:14 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NetAdapterCim provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2788; ProviderPath = %systemroot%\system32\wbem\NetAdapterCim.dll	5857	0	4611686018427387904	186	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2788	2624	WIN-5T344G8GM1H	S-1-5-19	1/16/2018 6:37:14 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2504; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll	5857	0	4611686018427387904	185	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2504	2192	WIN-5T344G8GM1H	S-1-5-20	1/16/2018 6:37:14 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2504; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll	5857	0	4611686018427387904	184	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2504	2440	WIN-5T344G8GM1H	S-1-5-20	1/16/2018 6:37:14 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4024; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll	5857	0	4611686018427387904	183	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	4024	3868	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 6:27:16 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
nettcpip provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1288; ProviderPath = %systemroot%\system32\wbem\NetTCPIP.dll	5857	0	4611686018427387904	182	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	1288	3280	WIN-5T344G8GM1H	S-1-5-20	1/16/2018 6:27:14 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NetAdapterCim provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1500; ProviderPath = %systemroot%\system32\wbem\NetAdapterCim.dll	5857	0	4611686018427387904	181	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	1500	2664	WIN-5T344G8GM1H	S-1-5-19	1/16/2018 6:27:14 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1288; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll	5857	0	4611686018427387904	180	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	1288	3280	WIN-5T344G8GM1H	S-1-5-20	1/16/2018 6:27:14 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1288; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll	5857	0	4611686018427387904	179	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	1288	4056	WIN-5T344G8GM1H	S-1-5-20	1/16/2018 6:27:14 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 652; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll	5857	0	4611686018427387904	178	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	652	1972	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 6:17:16 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
nettcpip provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4032; ProviderPath = %systemroot%\system32\wbem\NetTCPIP.dll	5857	0	4611686018427387904	177	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	4032	3152	WIN-5T344G8GM1H	S-1-5-20	1/16/2018 6:17:14 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NetAdapterCim provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3688; ProviderPath = %systemroot%\system32\wbem\NetAdapterCim.dll	5857	0	4611686018427387904	176	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	3688	3124	WIN-5T344G8GM1H	S-1-5-19	1/16/2018 6:17:14 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4032; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll	5857	0	4611686018427387904	175	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	4032	1184	WIN-5T344G8GM1H	S-1-5-20	1/16/2018 6:17:14 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4032; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll	5857	0	4611686018427387904	174	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	4032	1160	WIN-5T344G8GM1H	S-1-5-20	1/16/2018 6:17:14 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WMIProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1088; ProviderPath = %systemroot%\system32\wbem\wmiprov.dll	5857	0	4611686018427387904	173	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	1088	4088	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 6:10:25 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2784; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll	5857	0	4611686018427387904	172	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2784	1752	WIN-5T344G8GM1H	S-1-5-20	1/16/2018 6:08:29 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Namespace = //./root/CIMV2; NotificationQuery = select * from MSFT_SCMEventLogEvent; OwnerName = S-1-5-32-544; HostProcessID = 1176; Provider= SCM Event Provider, queryID = 0; PossibleCause = Permanent	5859	0	4611686018427387904	171	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	1176	3928	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 6:08:20 PM	b65c0852-8ef4-0003-8709-5cb6f48ed301	microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Namespace = //./root/subscription; Eventfilter = SCM Event Log Filter (refer to its activate eventid:5859); Consumer = NTEventLogEventConsumer="SCM Event Log Consumer"; PossibleCause = Binding EventFilter: instance of __EventFilter { CreatorSID = {1, 2, 0, 0, 0, 0, 0, 5, 32, 0, 0, 0, 32, 2, 0, 0}; EventNamespace = "root\\cimv2"; Name = "SCM Event Log Filter"; Query = "select * from MSFT_SCMEventLogEvent"; QueryLanguage = "WQL"; }; Perm. Consumer: instance of NTEventLogEventConsumer { Category = 0; CreatorSID = {1, 2, 0, 0, 0, 0, 0, 5, 32, 0, 0, 0, 32, 2, 0, 0}; EventType = 1; Name = "SCM Event Log Consumer"; NameOfUserSIDProperty = "sid"; SourceName = "Service Control Manager"; };	5861	0	4611686018427387904	170	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	1176	3928	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 6:08:20 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
MSVDS__PROVIDER provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2784; ProviderPath = %systemroot%\system32\wbem\vdswmi.dll	5857	0	4611686018427387904	169	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2784	1752	WIN-5T344G8GM1H	S-1-5-20	1/16/2018 6:07:37 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32a provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2784; ProviderPath = %systemroot%\system32\wbem\wmipcima.dll	5857	0	4611686018427387904	168	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2784	1752	WIN-5T344G8GM1H	S-1-5-20	1/16/2018 6:07:36 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
nettcpip provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2784; ProviderPath = %systemroot%\system32\wbem\NetTCPIP.dll	5857	0	4611686018427387904	167	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2784	4072	WIN-5T344G8GM1H	S-1-5-20	1/16/2018 6:07:14 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NetAdapterCim provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4076; ProviderPath = %systemroot%\system32\wbem\NetAdapterCim.dll	5857	0	4611686018427387904	166	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	4076	1920	WIN-5T344G8GM1H	S-1-5-19	1/16/2018 6:07:14 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2784; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll	5857	0	4611686018427387904	165	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2784	4060	WIN-5T344G8GM1H	S-1-5-20	1/16/2018 6:07:14 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2784; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll	5857	0	4611686018427387904	164	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2784	2824	WIN-5T344G8GM1H	S-1-5-20	1/16/2018 6:07:14 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 2584; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\Microsoft\Windows\DeviceGuard : SELECT AvailableSecurityProperties FROM Win32_DeviceGuard ; ResultCode = 0x80041032; PossibleCause = Unknown	5858	2	4611686018427387904	163	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	1176	2580	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 6:06:34 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 2584; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\Microsoft\Windows\DeviceGuard : SELECT RequiredSecurityProperties FROM Win32_DeviceGuard ; ResultCode = 0x80041032; PossibleCause = Unknown	5858	2	4611686018427387904	162	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	1176	2580	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 6:06:34 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 2584; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\Microsoft\Windows\DeviceGuard : SELECT SecurityServicesConfigured FROM Win32_DeviceGuard ; ResultCode = 0x80041032; PossibleCause = Unknown	5858	2	4611686018427387904	161	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	1176	2640	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 6:06:34 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Win32_TpmProvider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2784; ProviderPath = C:\Windows\system32\wbem\Win32_TPM.dll	5857	0	4611686018427387904	160	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2784	2824	WIN-5T344G8GM1H	S-1-5-20	1/16/2018 6:06:34 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 2584; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\Microsoft\Windows\DeviceGuard : SELECT VirtualizationBasedSecurityStatus FROM Win32_DeviceGuard ; ResultCode = 0x80041032; PossibleCause = Unknown	5858	2	4611686018427387904	159	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	1176	2640	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 6:06:33 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 2584; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\Microsoft\Windows\DeviceGuard : SELECT SecurityServicesRunning FROM Win32_DeviceGuard ; ResultCode = 0x80041032; PossibleCause = Unknown	5858	2	4611686018427387904	158	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	1176	2580	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 6:06:33 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 2584; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\Microsoft\Windows\DeviceGuard : SELECT SecurityServicesRunning FROM Win32_DeviceGuard ; ResultCode = 0x80041032; PossibleCause = Unknown	5858	2	4611686018427387904	157	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	1176	2580	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 6:06:33 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 2584; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\Microsoft\Windows\DeviceGuard : SELECT AvailableSecurityProperties FROM Win32_DeviceGuard ; ResultCode = 0x80041032; PossibleCause = Unknown	5858	2	4611686018427387904	156	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	1176	2580	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 6:06:33 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 2584; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\Microsoft\Windows\DeviceGuard : SELECT RequiredSecurityProperties FROM Win32_DeviceGuard ; ResultCode = 0x80041032; PossibleCause = Unknown	5858	2	4611686018427387904	155	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	1176	2580	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 6:06:33 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Win32_DeviceGuard provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2784; ProviderPath = %SystemRoot%\System32\Win32_DeviceGuard.dll	5857	0	4611686018427387904	154	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2784	2824	WIN-5T344G8GM1H	S-1-5-20	1/16/2018 6:06:33 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 2584; Component = Unknown; Operation = Start IWbemServices::ExecQuery - ROOT\CIMV2 : select ChassisTypes from Win32_SystemEnclosure; ResultCode = 0x80041032; PossibleCause = Unknown	5858	2	4611686018427387904	153	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	1176	2640	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 6:06:33 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2784; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll	5857	0	4611686018427387904	152	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2784	2824	WIN-5T344G8GM1H	S-1-5-20	1/16/2018 6:06:32 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 2584; Component = Unknown; Operation = Start IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT ID FROM Win32_ServerFeature; ResultCode = 0x80041032; PossibleCause = Unknown	5858	2	4611686018427387904	151	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	1176	2640	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 6:06:32 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2832; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll	5857	0	4611686018427387904	150	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2832	2860	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 6:06:27 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
ServerFeatureProvider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2784; ProviderPath = %windir%\system32\wbem\servercompprov.dll	5857	0	4611686018427387904	149	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2784	2812	WIN-5T344G8GM1H	S-1-5-20	1/16/2018 6:06:27 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4892; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll	5857	0	4611686018427387904	148	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	4892	836	WIN-5T344G8GM1H	S-1-5-20	1/16/2018 6:02:36 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4256; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll	5857	0	4611686018427387904	147	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	4256	4144	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:53:30 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
nettcpip provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4976; ProviderPath = %systemroot%\system32\wbem\NetTCPIP.dll	5857	0	4611686018427387904	146	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	4976	3800	WIN-5T344G8GM1H	S-1-5-20	1/16/2018 5:53:24 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NetAdapterCim provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 5092; ProviderPath = %systemroot%\system32\wbem\NetAdapterCim.dll	5857	0	4611686018427387904	145	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	5092	2628	WIN-5T344G8GM1H	S-1-5-19	1/16/2018 5:53:24 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4976; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll	5857	0	4611686018427387904	144	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	4976	3800	WIN-5T344G8GM1H	S-1-5-20	1/16/2018 5:53:23 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4976; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll	5857	0	4611686018427387904	143	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	4976	5116	WIN-5T344G8GM1H	S-1-5-20	1/16/2018 5:53:23 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {53B2B737-8EF1-0000-6DB9-B253F18ED301}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 1152; Component = Unknown; Operation = Start IWbemServices::ExecNotificationQuery - ROOT\CIMV2 : SELECT * FROM Win32_ProcessStartTrace WHERE ProcessName = 'wsmprovhost.exe'; ResultCode = 0x80041032; PossibleCause = Unknown	5858	2	4611686018427387904	142	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	1152	4780	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:50:11 PM	53b2b737-8ef1-0000-6db9-b253f18ed301	microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WMIProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3688; ProviderPath = %systemroot%\system32\wbem\wmiprov.dll	5857	0	4611686018427387904	141	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	3688	2160	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:46:15 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Namespace = ROOT\CIMV2; NotificationQuery = SELECT * FROM Win32_ProcessStartTrace WHERE ProcessName = 'wsmprovhost.exe'; UserName = ; ClientProcessID = 1152, ClientMachine = WIN-5T344G8GM1H; PossibleCause = Temporary	5860	0	4611686018427387904	140	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	1152	4676	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:44:23 PM	53b2b737-8ef1-0003-feb9-b253f18ed301	microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WMI Kernel Trace Event Provider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1152; ProviderPath = C:\Windows\System32\wbem\krnlprov.dll	5857	0	4611686018427387904	139	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	1152	4676	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:44:23 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 400; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_ComputerSystemProduct; ResultCode = 0x80041032; PossibleCause = Unknown	5858	2	4611686018427387904	138	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	1152	2600	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:44:12 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4212; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll	5857	0	4611686018427387904	137	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	4212	4236	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:43:31 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
MSVDS__PROVIDER provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 976; ProviderPath = %systemroot%\system32\wbem\vdswmi.dll	5857	0	4611686018427387904	136	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	976	2796	WIN-5T344G8GM1H	S-1-5-20	1/16/2018 5:43:29 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
nettcpip provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 976; ProviderPath = %systemroot%\system32\wbem\NetTCPIP.dll	5857	0	4611686018427387904	135	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	976	3216	WIN-5T344G8GM1H	S-1-5-20	1/16/2018 5:43:23 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NetAdapterCim provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3208; ProviderPath = %systemroot%\system32\wbem\NetAdapterCim.dll	5857	0	4611686018427387904	134	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	3208	3308	WIN-5T344G8GM1H	S-1-5-19	1/16/2018 5:43:23 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 976; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll	5857	0	4611686018427387904	133	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	976	324	WIN-5T344G8GM1H	S-1-5-20	1/16/2018 5:43:23 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32a provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 976; ProviderPath = %systemroot%\system32\wbem\wmipcima.dll	5857	0	4611686018427387904	132	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	976	324	WIN-5T344G8GM1H	S-1-5-20	1/16/2018 5:43:17 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 976; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll	5857	0	4611686018427387904	131	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	976	324	WIN-5T344G8GM1H	S-1-5-20	1/16/2018 5:43:17 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Namespace = //./root/CIMV2; NotificationQuery = select * from MSFT_SCMEventLogEvent; OwnerName = S-1-5-32-544; HostProcessID = 1152; Provider= SCM Event Provider, queryID = 0; PossibleCause = Permanent	5859	0	4611686018427387904	130	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	1152	2720	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:42:38 PM	53b2b737-8ef1-0001-8eb7-b253f18ed301	microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Namespace = //./root/subscription; Eventfilter = SCM Event Log Filter (refer to its activate eventid:5859); Consumer = NTEventLogEventConsumer="SCM Event Log Consumer"; PossibleCause = Binding EventFilter: instance of __EventFilter { CreatorSID = {1, 2, 0, 0, 0, 0, 0, 5, 32, 0, 0, 0, 32, 2, 0, 0}; EventNamespace = "root\\cimv2"; Name = "SCM Event Log Filter"; Query = "select * from MSFT_SCMEventLogEvent"; QueryLanguage = "WQL"; }; Perm. Consumer: instance of NTEventLogEventConsumer { Category = 0; CreatorSID = {1, 2, 0, 0, 0, 0, 0, 5, 32, 0, 0, 0, 32, 2, 0, 0}; EventType = 1; Name = "SCM Event Log Consumer"; NameOfUserSIDProperty = "sid"; SourceName = "Service Control Manager"; };	5861	0	4611686018427387904	129	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	1152	2720	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:42:38 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {A4626349-8EA8-0003-B36D-62A4A88ED301}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::ExecNotificationQuery - ROOT\CIMV2 : SELECT * FROM Win32_ProcessStartTrace WHERE ProcessName = 'wsmprovhost.exe'; ResultCode = 0x80041032; PossibleCause = Unknown	5858	2	4611686018427387904	128	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	3696	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:37:24 PM	a4626349-8ea8-0003-b36d-62a4a88ed301	microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 164; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll	5857	0	4611686018427387904	127	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	164	3628	WIN-5T344G8GM1H	S-1-5-20	1/16/2018 5:35:48 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WmiPerfInst provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3868; ProviderPath = C:\Windows\System32\wbem\WmiPerfInst.dll	5857	0	4611686018427387904	126	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	3868	1388	WIN-5T344G8GM1H	S-1-5-19	1/16/2018 5:35:07 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WMIProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4924; ProviderPath = %systemroot%\system32\wbem\wmiprov.dll	5857	0	4611686018427387904	125	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	4924	428	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:35:04 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WmiPerfClass provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4924; ProviderPath = C:\Windows\System32\wbem\WmiPerfClass.dll	5857	0	4611686018427387904	124	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	4924	5928	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:35:03 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Namespace = ROOT\CIMV2; NotificationQuery = SELECT * FROM Win32_ProcessStartTrace WHERE ProcessName = 'wsmprovhost.exe'; UserName = ; ClientProcessID = 924, ClientMachine = WIN-5T344G8GM1H; PossibleCause = Temporary	5860	0	4611686018427387904	123	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2052	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:34:06 PM	a4626349-8ea8-0002-ed6e-62a4a88ed301	microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WMI Kernel Trace Event Provider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 924; ProviderPath = C:\Windows\System32\wbem\krnlprov.dll	5857	0	4611686018427387904	122	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2052	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:34:06 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 5028; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll	5857	0	4611686018427387904	121	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	5028	5328	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:32:53 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
nettcpip provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 5804; ProviderPath = %systemroot%\system32\wbem\NetTCPIP.dll	5857	0	4611686018427387904	120	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	5804	5824	WIN-5T344G8GM1H	S-1-5-20	1/16/2018 5:32:40 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NetAdapterCim provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3816; ProviderPath = %systemroot%\system32\wbem\NetAdapterCim.dll	5857	0	4611686018427387904	119	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	3816	1224	WIN-5T344G8GM1H	S-1-5-19	1/16/2018 5:32:40 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 5804; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll	5857	0	4611686018427387904	118	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	5804	5824	WIN-5T344G8GM1H	S-1-5-20	1/16/2018 5:32:40 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 5804; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll	5857	0	4611686018427387904	117	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	5804	912	WIN-5T344G8GM1H	S-1-5-20	1/16/2018 5:32:40 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3180; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll	5857	0	4611686018427387904	116	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	3180	804	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:22:47 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
nettcpip provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3772; ProviderPath = %systemroot%\system32\wbem\NetTCPIP.dll	5857	0	4611686018427387904	115	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	3772	5300	WIN-5T344G8GM1H	S-1-5-20	1/16/2018 5:22:40 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NetAdapterCim provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 888; ProviderPath = %systemroot%\system32\wbem\NetAdapterCim.dll	5857	0	4611686018427387904	114	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	888	5288	WIN-5T344G8GM1H	S-1-5-19	1/16/2018 5:22:40 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3772; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll	5857	0	4611686018427387904	113	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	3772	5300	WIN-5T344G8GM1H	S-1-5-20	1/16/2018 5:22:40 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3772; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll	5857	0	4611686018427387904	112	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	3772	3704	WIN-5T344G8GM1H	S-1-5-20	1/16/2018 5:22:40 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 5964; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll	5857	0	4611686018427387904	111	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	5964	3468	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:12:54 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {A4626349-8EA8-0000-8A6D-62A4A88ED301}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::ExecNotificationQuery - ROOT\CIMV2 : SELECT * FROM Win32_ProcessStartTrace WHERE ProcessName = 'wsmprovhost.exe'; ResultCode = 0x80041032; PossibleCause = Unknown	5858	2	4611686018427387904	110	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	1992	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:12:41 PM	a4626349-8ea8-0000-8a6d-62a4a88ed301	microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
nettcpip provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1260; ProviderPath = %systemroot%\system32\wbem\NetTCPIP.dll	5857	0	4611686018427387904	109	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	1260	1960	WIN-5T344G8GM1H	S-1-5-20	1/16/2018 5:12:40 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NetAdapterCim provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2736; ProviderPath = %systemroot%\system32\wbem\NetAdapterCim.dll	5857	0	4611686018427387904	108	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2736	2320	WIN-5T344G8GM1H	S-1-5-19	1/16/2018 5:12:40 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1260; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll	5857	0	4611686018427387904	107	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	1260	1960	WIN-5T344G8GM1H	S-1-5-20	1/16/2018 5:12:40 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1260; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll	5857	0	4611686018427387904	106	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	1260	1936	WIN-5T344G8GM1H	S-1-5-20	1/16/2018 5:12:40 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Namespace = ROOT\CIMV2; NotificationQuery = SELECT * FROM Win32_ProcessStartTrace WHERE ProcessName = 'wsmprovhost.exe'; UserName = ; ClientProcessID = 924, ClientMachine = WIN-5T344G8GM1H; PossibleCause = Temporary	5860	0	4611686018427387904	105	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	3016	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:06:17 PM	a4626349-8ea8-0003-146c-62a4a88ed301	microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WMI Kernel Trace Event Provider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 924; ProviderPath = C:\Windows\System32\wbem\krnlprov.dll	5857	0	4611686018427387904	104	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	3016	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:06:17 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
MSVDS__PROVIDER provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3428; ProviderPath = %systemroot%\system32\wbem\vdswmi.dll	5857	0	4611686018427387904	103	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	3428	5844	WIN-5T344G8GM1H	S-1-5-20	1/16/2018 5:06:06 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3428; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll	5857	0	4611686018427387904	102	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	3428	5844	WIN-5T344G8GM1H	S-1-5-20	1/16/2018 5:06:06 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WMIProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2768; ProviderPath = %systemroot%\system32\wbem\wmiprov.dll	5857	0	4611686018427387904	101	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2768	1104	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:05:59 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2856; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll	5857	0	4611686018427387904	100	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2856	3704	WIN-5T344G8GM1H	S-1-5-20	1/16/2018 5:04:01 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Namespace = //./root/CIMV2; NotificationQuery = select * from MSFT_SCMEventLogEvent; OwnerName = S-1-5-32-544; HostProcessID = 924; Provider= SCM Event Provider, queryID = 0; PossibleCause = Permanent	5859	0	4611686018427387904	99	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	3356	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:03:48 PM	a4626349-8ea8-0003-c36b-62a4a88ed301	microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Namespace = //./root/subscription; Eventfilter = SCM Event Log Filter (refer to its activate eventid:5859); Consumer = NTEventLogEventConsumer="SCM Event Log Consumer"; PossibleCause = Binding EventFilter: instance of __EventFilter { CreatorSID = {1, 2, 0, 0, 0, 0, 0, 5, 32, 0, 0, 0, 32, 2, 0, 0}; EventNamespace = "root\\cimv2"; Name = "SCM Event Log Filter"; Query = "select * from MSFT_SCMEventLogEvent"; QueryLanguage = "WQL"; }; Perm. Consumer: instance of NTEventLogEventConsumer { Category = 0; CreatorSID = {1, 2, 0, 0, 0, 0, 0, 5, 32, 0, 0, 0, 32, 2, 0, 0}; EventType = 1; Name = "SCM Event Log Consumer"; NameOfUserSIDProperty = "sid"; SourceName = "Service Control Manager"; };	5861	0	4611686018427387904	98	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	1768	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:03:48 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
MSVDS__PROVIDER provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2856; ProviderPath = %systemroot%\system32\wbem\vdswmi.dll	5857	0	4611686018427387904	97	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2856	3704	WIN-5T344G8GM1H	S-1-5-20	1/16/2018 5:02:51 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
nettcpip provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2856; ProviderPath = %systemroot%\system32\wbem\NetTCPIP.dll	5857	0	4611686018427387904	96	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2856	812	WIN-5T344G8GM1H	S-1-5-20	1/16/2018 5:02:39 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NetAdapterCim provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 5960; ProviderPath = %systemroot%\system32\wbem\NetAdapterCim.dll	5857	0	4611686018427387904	95	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	5960	5988	WIN-5T344G8GM1H	S-1-5-19	1/16/2018 5:02:39 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2856; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll	5857	0	4611686018427387904	94	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2856	3084	WIN-5T344G8GM1H	S-1-5-20	1/16/2018 5:02:39 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 2972; Component = Unknown; Operation = Start IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT ID FROM Win32_ServerFeature; ResultCode = 0x80041032; PossibleCause = Unknown	5858	2	4611686018427387904	93	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2352	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:13 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{FB2CA36D-0B40-4307-821B-A13B252DE56C}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	92	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2512	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:11 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{F9C77450-3A41-477E-9310-9ACD617BD9E3}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	91	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2512	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:11 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{E62688F0-25FD-4c90-BFF5-F508B9D2E31F}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	90	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2512	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:11 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{E5094040-C46C-4115-B030-04FB2E545B00}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	89	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2512	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:11 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{E4F48E54-F38D-4884-BFB9-D4D2E5729C18}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	88	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2512	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:11 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{E47248BA-94CC-49c4-BBB5-9EB7F05183D0}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	87	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2512	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:11 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{CF7639F3-ABA2-41DB-97F2-81E2C5DBFC5D}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	86	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2512	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:11 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{c6dc5466-785a-11d2-84d0-00c04fb169f7}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	85	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2512	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:11 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{C631DF4C-088F-4156-B058-4375F0853CD8}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	84	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2512	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:11 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{C418DD9D-0D14-4efb-8FBF-CFE535C8FAC7}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	83	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2512	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:11 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{C34B2751-1CF4-44F5-9262-C3FC39666591}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	82	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2512	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:11 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{BC75B1ED-5833-4858-9BB8-CBF0B166DF9D}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	81	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2512	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:11 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{BA649533-0AAC-4E04-B9BC-4DBAE0325B12}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	80	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2512	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:11 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{B087BE9D-ED37-454f-AF9C-04291E351182}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	79	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2512	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:11 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{AADCED64-746C-4633-A97C-D61349046527}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	78	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2512	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:11 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{A3F3E39B-5D83-4940-B954-28315B82F0A8}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	77	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2512	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:11 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{91FBB303-0CD5-4055-BF42-E512A681B325}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	76	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2512	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:11 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{8A28E2C5-8D06-49A4-A08C-632DAA493E17}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	75	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2512	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:11 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{7B849a69-220F-451E-B3FE-2CB811AF94AE}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	74	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2512	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:11 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{7933F41E-56F8-41d6-A31C-4148A711EE93}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	73	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2512	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:11 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{74EE6C03-5363-4554-B161-627540339CAB}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	72	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2512	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:11 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{728EE579-943C-4519-9EF7-AB56765798ED}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	71	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2512	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:11 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{7150F9BF-48AD-4da4-A49C-29EF4A8369BA}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	70	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2512	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:11 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{6232C319-91AC-4931-9385-E70C2B099F0E}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	69	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2512	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:11 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{5794DAFD-BE60-433f-88A2-1A31939AC01F}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	68	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2512	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:11 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{4D2F9B6F-1E52-4711-A382-6A8B1A003DE6}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	67	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2512	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:11 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{4CFB60C1-FAA6-47f1-89AA-0B18730C9FD3}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	66	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2512	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:11 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{4B7C3B0F-E993-4E06-A241-3FBE06943684}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	65	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2512	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:11 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{42B5FAAE-6536-11d2-AE5A-0000F87571E3}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	64	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2512	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:11 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{3A0DBA37-F8B2-4356-83DE-3E90BD5C261F}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	63	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2512	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:11 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{2BFCC077-22D2-48DE-BDE1-2F618D9B476D}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	62	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2512	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:11 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{25537BA6-77A8-11D2-9B6C-0000F8080861}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	61	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2512	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:11 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{1A6364EB-776B-4120-ADE1-B63A406A76B5}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	60	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2512	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:11 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{17D89FEC-5C44-4972-B12D-241CAEF74509}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	59	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2512	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:11 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{169EBF44-942F-4C43-87CE-13C93996EBBE}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	58	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2512	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:11 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{0E28E245-9368-4853-AD84-6DA3BA35BB75}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	57	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2512	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:11 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WMIProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2768; ProviderPath = %systemroot%\system32\wbem\wmiprov.dll	5857	0	4611686018427387904	56	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2768	1124	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:11 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WMIProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2768; ProviderPath = %systemroot%\system32\wbem\wmiprov.dll	5857	0	4611686018427387904	55	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2768	1124	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:11 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{FC491EF1-C4AA-4CE1-B329-414B101DB823}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	54	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2528	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:09 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{fbf687e6-f063-4d9f-9f4f-fd9a26acdd5f}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	53	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2528	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:09 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{FB2CA36D-0B40-4307-821B-A13B252DE56C}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	52	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2528	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:09 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{f3ccc681-b74c-4060-9f26-cd84525dca2a}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	51	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2528	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:09 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{F312195E-3D9D-447A-A3F5-08DFFA24735E}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	50	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2528	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:09 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{E62688F0-25FD-4c90-BFF5-F508B9D2E31F}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	49	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2528	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:09 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{E5094040-C46C-4115-B030-04FB2E545B00}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	48	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2528	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:09 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{E4F48E54-F38D-4884-BFB9-D4D2E5729C18}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	47	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2528	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:09 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{e437bc1c-aa7d-11d2-a382-00c04f991e27}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	46	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2528	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:09 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{CF7639F3-ABA2-41DB-97F2-81E2C5DBFC5D}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	45	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2528	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:09 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{cdeafc3d-948d-49dd-ab12-e578ba4af7aa}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	44	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2528	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:09 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{c6dc5466-785a-11d2-84d0-00c04fb169f7}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	43	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2528	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:09 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{C631DF4C-088F-4156-B058-4375F0853CD8}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	42	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2528	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:09 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{C418DD9D-0D14-4efb-8FBF-CFE535C8FAC7}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	41	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2528	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:09 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{C34B2751-1CF4-44F5-9262-C3FC39666591}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	40	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2528	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:09 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{BC75B1ED-5833-4858-9BB8-CBF0B166DF9D}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	39	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2528	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:09 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{BA649533-0AAC-4E04-B9BC-4DBAE0325B12}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	38	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2528	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:09 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{B587E2B1-4D59-4e7e-AED9-22B9DF11D053}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	37	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2528	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:09 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{B087BE9D-ED37-454f-AF9C-04291E351182}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	36	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2528	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:09 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{AADCED64-746C-4633-A97C-D61349046527}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	35	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2528	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:09 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{A3F3E39B-5D83-4940-B954-28315B82F0A8}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	34	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2528	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:09 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{91FBB303-0CD5-4055-BF42-E512A681B325}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	33	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2528	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:09 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{8A28E2C5-8D06-49A4-A08C-632DAA493E17}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	32	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2528	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:09 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{827D319E-6EAC-11D2-A4EA-00C04F79F83A}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	31	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2528	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:09 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{7B849a69-220F-451E-B3FE-2CB811AF94AE}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	30	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2528	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:09 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{7933F41E-56F8-41d6-A31C-4148A711EE93}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	29	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2528	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:09 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{74EE6C03-5363-4554-B161-627540339CAB}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	28	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2528	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:09 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{728EE579-943C-4519-9EF7-AB56765798ED}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	27	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2528	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:09 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{7150F9BF-48AD-4da4-A49C-29EF4A8369BA}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	26	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2528	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:09 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{6A4C88C6-C502-4f74-8F60-2CB23EDC24E2}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	25	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2528	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:09 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{6232C319-91AC-4931-9385-E70C2B099F0E}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	24	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2528	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:09 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{4CFB60C1-FAA6-47f1-89AA-0B18730C9FD3}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	23	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2528	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:09 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{4bcd6cde-777b-48b6-9804-43568e23545d}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	22	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2528	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:09 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{4B7C3B0F-E993-4E06-A241-3FBE06943684}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	21	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2528	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:09 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{42B5FAAE-6536-11d2-AE5A-0000F87571E3}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	20	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2528	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:09 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{426031c0-0b47-4852-b0ca-ac3d37bfcb39}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	19	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2528	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:09 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{3A0DBA37-F8B2-4356-83DE-3E90BD5C261F}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	18	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2528	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:09 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{3610eda5-77ef-11d2-8dc5-00c04fa31a66}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	17	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2528	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:09 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{2BFCC077-22D2-48DE-BDE1-2F618D9B476D}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	16	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2528	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:09 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{2A8FDC61-2347-4C87-92F6-B05EB91A201A}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	15	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2528	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:09 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{1A6364EB-776B-4120-ADE1-B63A406A76B5}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	14	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2528	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:09 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{17D89FEC-5C44-4972-B12D-241CAEF74509}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	13	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2528	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:09 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{16be69fa-4209-4250-88cb-716cf41954e0}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	12	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2528	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:09 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{169EBF44-942F-4C43-87CE-13C93996EBBE}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	11	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2528	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:09 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{0E28E245-9368-4853-AD84-6DA3BA35BB75}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	10	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2528	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:09 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{0ACDD40C-75AC-47ab-BAA0-BF6DE7E7FE63}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	9	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2528	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:09 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{35378EAC-683F-11D2-A89A-00C04FBBCFA2}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	8	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2528	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:09 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3440; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll	5857	0	4611686018427387904	7	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	3440	3468	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:09 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
ServerFeatureProvider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2856; ProviderPath = %windir%\system32\wbem\servercompprov.dll	5857	0	4611686018427387904	6	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2856	3084	WIN-5T344G8GM1H	S-1-5-20	1/16/2018 5:02:09 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 2972; Component = Unknown; Operation = Start IWbemServices::ExecQuery - ROOT\CIMV2 : select ChassisTypes from Win32_SystemEnclosure; ResultCode = 0x80041032; PossibleCause = Unknown	5858	2	4611686018427387904	5	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2484	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:09 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32a provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2856; ProviderPath = %systemroot%\system32\wbem\wmipcima.dll	5857	0	4611686018427387904	4	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2856	3084	WIN-5T344G8GM1H	S-1-5-20	1/16/2018 5:02:06 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2856; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll	5857	0	4611686018427387904	3	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2856	2436	WIN-5T344G8GM1H	S-1-5-20	1/16/2018 5:02:05 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-PD8DQPRRTAO; User = NT AUTHORITY\SYSTEM; ClientProcessId = 2508; Component = Unknown; Operation = Start IWbemServices::CreateInstanceEnum - root\wmi : MSiSCSI_PortalInfoClass; ResultCode = 0x8004100A; PossibleCause = Unknown	5858	2	4611686018427387904	2	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	916	2392	WIN-PD8DQPRRTAO	S-1-5-18	1/16/2018 5:01:40 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-PD8DQPRRTAO; User = NT AUTHORITY\SYSTEM; ClientProcessId = 2508; Component = Unknown; Operation = Start IWbemServices::CreateInstanceEnum - root\wmi : MS_SM_AdapterInformationQuery; ResultCode = 0x8004100A; PossibleCause = Unknown	5858	2	4611686018427387904	1	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	916	2392	WIN-PD8DQPRRTAO	S-1-5-18	1/16/2018 5:01:40 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]