Message	Id	Level	Keywords	RecordId	ProviderName	ProviderId	LogName	ProcessId	ThreadId	MachineName	UserId	TimeCreated	ActivityId	ContainerLog	MatchedQueryIds	Bookmark	LevelDisplayName	OpcodeDisplayName	KeywordsDisplayNames	Properties
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4028; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll	5857	0	4611686018427387904	844	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	4028	4856	hv-cinder-80696	S-1-5-18	9/15/2021 4:09:01 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4804; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll	5857	0	4611686018427387904	843	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	4804	1460	hv-cinder-80696	S-1-5-20	9/15/2021 4:09:01 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {AC988B94-AB09-4838-8EB8-9A826A87CAF4}; ClientMachine = HV-CINDER-80696; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3020; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=990202896; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	842	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	552	2232	hv-cinder-80696	S-1-5-18	9/15/2021 4:08:40 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {01A4B423-3914-4BD7-A2FB-53BAA2559901}; ClientMachine = HV-CINDER-80696; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3020; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Host.HostName="iqn.2010-10.org.openstack:volume-9064659f-963b-4909-ac37-86a8cd3700fb"; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	841	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	552	3004	hv-cinder-80696	S-1-5-18	9/15/2021 4:08:39 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {EB18E71F-1A2C-453D-BC97-D0EC188F3CEA}; ClientMachine = HV-CINDER-80696; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3020; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_IDMethod.HostName="iqn.2010-10.org.openstack:volume-9064659f-963b-4909-ac37-86a8cd3700fb",Method=4,Value="iqn.1991-05.com.microsoft:hv-cinder-80696"; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	840	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	552	3004	hv-cinder-80696	S-1-5-18	9/15/2021 4:08:39 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {2058B100-007C-4A84-B67E-B7BEC5C638C1}; ClientMachine = HV-CINDER-80696; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3020; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{85BA3D2B-BC86-4D0E-B5EF-A1DE4B5C701B}"; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	839	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	552	2232	hv-cinder-80696	S-1-5-18	9/15/2021 4:08:34 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {ADDC368A-CE9B-43C2-9176-F51A269FE376}; ClientMachine = HV-CINDER-80696; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3020; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1272492256; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	838	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	552	2232	hv-cinder-80696	S-1-5-18	9/15/2021 4:08:33 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {B1D306BA-E188-4FC8-991E-F578BFF9D2BE}; ClientMachine = HV-CINDER-80696; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3020; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Host.HostName="iqn.2010-10.org.openstack:volume-c6cb0588-ccdd-4c05-abc5-86eb866bc0a4"; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	837	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	552	2164	hv-cinder-80696	S-1-5-18	9/15/2021 4:08:31 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {469B0E86-6E4C-48B4-85AB-28CC2547343E}; ClientMachine = HV-CINDER-80696; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3020; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_IDMethod.HostName="iqn.2010-10.org.openstack:volume-c6cb0588-ccdd-4c05-abc5-86eb866bc0a4",Method=4,Value="iqn.1991-05.com.microsoft:hv-cinder-80696"; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	836	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	552	2232	hv-cinder-80696	S-1-5-18	9/15/2021 4:08:31 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WinTargetProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4924; ProviderPath = C:\windows\system32\wbem\WTWMIProv.dll	5857	0	4611686018427387904	835	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	4924	1868	hv-cinder-80696	S-1-5-19	9/15/2021 4:08:31 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
StorageWMI provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4804; ProviderPath = %SystemRoot%\System32\storagewmi.dll	5857	0	4611686018427387904	834	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	4804	1460	hv-cinder-80696	S-1-5-20	9/15/2021 4:08:30 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4804; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll	5857	0	4611686018427387904	833	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	4804	1460	hv-cinder-80696	S-1-5-20	9/15/2021 4:07:31 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
StorageWMI provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4804; ProviderPath = %SystemRoot%\System32\storagewmi.dll	5857	0	4611686018427387904	832	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	4804	1460	hv-cinder-80696	S-1-5-20	9/15/2021 4:06:44 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
MSVSS__PROVIDER provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4804; ProviderPath = %systemroot%\system32\wbem\vsswmi.dll	5857	0	4611686018427387904	831	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	4804	1460	hv-cinder-80696	S-1-5-20	9/15/2021 4:06:39 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {C8B065E6-9D80-4280-8DAD-12CAD0318581}; ClientMachine = HV-CINDER-80696; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3020; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1770571964; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	830	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	552	1160	hv-cinder-80696	S-1-5-18	9/15/2021 4:06:39 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WinTargetProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3804; ProviderPath = C:\windows\system32\wbem\WTWMIProv.dll	5857	0	4611686018427387904	829	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	3804	4840	hv-cinder-80696	S-1-5-19	9/15/2021 4:06:32 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4804; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll	5857	0	4611686018427387904	828	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	4804	1460	hv-cinder-80696	S-1-5-20	9/15/2021 4:05:30 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {E9AFD428-4E57-4782-9490-07CFB109B2BA}; ClientMachine = HV-CINDER-80696; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3020; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Host.HostName="iqn.2010-10.org.openstack:volume-9064659f-963b-4909-ac37-86a8cd3700fb"; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	827	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	552	2288	hv-cinder-80696	S-1-5-18	9/15/2021 4:04:43 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {691437B8-B656-413B-8A7C-02C22A0A8E38}; ClientMachine = HV-CINDER-80696; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3020; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_IDMethod.HostName="iqn.2010-10.org.openstack:volume-9064659f-963b-4909-ac37-86a8cd3700fb",Method=4,Value="iqn.1991-05.com.microsoft:hv-cinder-80696"; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	826	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	552	2288	hv-cinder-80696	S-1-5-18	9/15/2021 4:04:43 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
StorageWMI provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4804; ProviderPath = %SystemRoot%\System32\storagewmi.dll	5857	0	4611686018427387904	825	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	4804	1460	hv-cinder-80696	S-1-5-20	9/15/2021 4:04:42 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {178EA5B1-0E43-4660-9F03-3F10CDDA7AE6}; ClientMachine = HV-CINDER-80696; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3020; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1757953736; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	824	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	552	2232	hv-cinder-80696	S-1-5-18	9/15/2021 4:04:18 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {A0264946-3A4D-4B8B-88A6-BBA53D1FD18D}; ClientMachine = HV-CINDER-80696; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3020; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=810805232; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	823	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	552	2940	hv-cinder-80696	S-1-5-18	9/15/2021 4:04:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {A89A8ACA-0917-4938-AC08-EDE152C8F636}; ClientMachine = HV-CINDER-80696; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3020; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=355316157; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	822	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	552	2940	hv-cinder-80696	S-1-5-18	9/15/2021 4:04:16 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {045FCF4D-42F5-4716-8B2C-35762F21354C}; ClientMachine = HV-CINDER-80696; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3020; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1607030682; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	821	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	552	2288	hv-cinder-80696	S-1-5-18	9/15/2021 4:04:01 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9528F001-BD0D-4291-9648-600DC3957FF4}; ClientMachine = HV-CINDER-80696; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3020; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=530909735; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	820	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	552	2288	hv-cinder-80696	S-1-5-18	9/15/2021 4:03:53 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {DB81915A-7F56-4125-B8F1-FEC0A8318B1B}; ClientMachine = HV-CINDER-80696; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3020; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{A48D24CA-4D65-46FA-8590-43BAED013746}"; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	819	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	552	2940	hv-cinder-80696	S-1-5-18	9/15/2021 4:03:52 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
MSVSS__PROVIDER provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4804; ProviderPath = %systemroot%\system32\wbem\vsswmi.dll	5857	0	4611686018427387904	818	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	4804	1460	hv-cinder-80696	S-1-5-20	9/15/2021 4:03:47 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WinTargetProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 5036; ProviderPath = C:\windows\system32\wbem\WTWMIProv.dll	5857	0	4611686018427387904	817	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	5036	1140	hv-cinder-80696	S-1-5-19	9/15/2021 4:03:47 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4804; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll	5857	0	4611686018427387904	816	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	4804	1460	hv-cinder-80696	S-1-5-20	9/15/2021 4:03:30 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {B559BA20-580C-415C-9A8A-4E6F4018FAD9}; ClientMachine = HV-CINDER-80696; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3020; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1457658979; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	815	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	552	2232	hv-cinder-80696	S-1-5-18	9/15/2021 4:02:53 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {0DC6AAD1-D1A1-4B1F-9360-E112D4CA873A}; ClientMachine = HV-CINDER-80696; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3020; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1545191925; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	814	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	552	3004	hv-cinder-80696	S-1-5-18	9/15/2021 4:02:52 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {08259C69-3E87-422C-A748-42779B4D62F1}; ClientMachine = HV-CINDER-80696; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3020; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1708557026; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	813	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	552	3004	hv-cinder-80696	S-1-5-18	9/15/2021 4:02:50 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9EC601A7-A907-4A23-86E5-32C980047D72}; ClientMachine = HV-CINDER-80696; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3020; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=152848312; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	812	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	552	2288	hv-cinder-80696	S-1-5-18	9/15/2021 4:02:29 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {EF3F5A32-4E65-4D15-9699-3F38DBE39B06}; ClientMachine = HV-CINDER-80696; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3020; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=962077219; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	811	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	552	2288	hv-cinder-80696	S-1-5-18	9/15/2021 4:02:28 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {65A235EC-AD1B-4DA9-80BB-B9BFB6147EC3}; ClientMachine = HV-CINDER-80696; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3020; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{53B9F2BD-3C5B-4460-924E-DA733EC37A6C}"; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	810	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	552	5100	hv-cinder-80696	S-1-5-18	9/15/2021 4:02:25 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {0B4BD688-00E9-42D1-A4CC-E8C865BC7EC8}; ClientMachine = HV-CINDER-80696; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3020; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=120148025; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	809	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	552	5100	hv-cinder-80696	S-1-5-18	9/15/2021 4:02:25 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
StorageWMI provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4804; ProviderPath = %SystemRoot%\System32\storagewmi.dll	5857	0	4611686018427387904	808	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	4804	1460	hv-cinder-80696	S-1-5-20	9/15/2021 4:02:20 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {663C726B-6964-4BAD-8787-2236E6494F13}; ClientMachine = HV-CINDER-80696; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3020; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=222073473; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	807	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	552	1356	hv-cinder-80696	S-1-5-18	9/15/2021 4:02:19 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {E03B198B-5C0B-4FF9-A144-22F03B8E9F95}; ClientMachine = HV-CINDER-80696; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3020; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=458379380; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	806	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	552	1356	hv-cinder-80696	S-1-5-18	9/15/2021 4:02:18 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {11415B04-6503-44EC-B177-B0F5E7277B3D}; ClientMachine = HV-CINDER-80696; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3020; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=2009030520; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	805	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	552	5100	hv-cinder-80696	S-1-5-18	9/15/2021 4:02:12 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9F7572DD-5006-4381-8830-75B8A4E408E0}; ClientMachine = HV-CINDER-80696; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3020; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{9247715E-3A89-4808-BCF7-82127FBFA1B3}"; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	804	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	552	5100	hv-cinder-80696	S-1-5-18	9/15/2021 4:02:11 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {B307C966-D5BA-481E-A23E-879BE5061B97}; ClientMachine = HV-CINDER-80696; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3020; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=734058149; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	803	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	552	2288	hv-cinder-80696	S-1-5-18	9/15/2021 4:02:00 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {2C45EE4F-A8AC-4B8F-BD24-E126A184B56C}; ClientMachine = HV-CINDER-80696; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3020; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=671648511; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	802	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	552	5100	hv-cinder-80696	S-1-5-18	9/15/2021 4:01:57 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {0E7F5973-CD1E-4C23-B027-F2C8D75D2AC1}; ClientMachine = HV-CINDER-80696; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3020; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=2086093265; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	801	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	552	1356	hv-cinder-80696	S-1-5-18	9/15/2021 4:01:55 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {057CC4DD-F52B-40A0-8436-99B7A19193B9}; ClientMachine = HV-CINDER-80696; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3020; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1775405611; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	800	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	552	1356	hv-cinder-80696	S-1-5-18	9/15/2021 4:01:52 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {1D7C58F4-F41D-41BC-9DA6-D4E2AE8B2015}; ClientMachine = HV-CINDER-80696; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3020; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1276241013; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	799	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	552	1356	hv-cinder-80696	S-1-5-18	9/15/2021 4:01:49 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9FAD86E3-8D23-4B9B-AF36-8A26C5A04C06}; ClientMachine = HV-CINDER-80696; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3020; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=350684789; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	798	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	552	1356	hv-cinder-80696	S-1-5-18	9/15/2021 4:01:39 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {8F5C6F6C-F9B1-45D0-851D-55DA33D6B476}; ClientMachine = HV-CINDER-80696; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3020; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{03EFB095-DD05-424A-A030-4D6AB15F280F}"; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	797	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	552	1356	hv-cinder-80696	S-1-5-18	9/15/2021 4:01:38 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {5470B39C-932A-460D-BB27-5BB5368CE898}; ClientMachine = HV-CINDER-80696; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3020; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{A88E8726-BBC9-4A62-B7D2-8A6CE3CCFB46}"; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	796	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	552	1356	hv-cinder-80696	S-1-5-18	9/15/2021 4:01:37 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {201B1B34-64DE-407D-AED2-4C0F68156B39}; ClientMachine = HV-CINDER-80696; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3020; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1341095395; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	795	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	552	2288	hv-cinder-80696	S-1-5-18	9/15/2021 4:01:36 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {2C4023D0-8959-427B-A9E4-A24A82A39673}; ClientMachine = HV-CINDER-80696; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3020; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1765647856; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	794	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	552	1356	hv-cinder-80696	S-1-5-18	9/15/2021 4:01:36 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {7FACB51E-3BD8-4EC3-85D9-23D48984B0D0}; ClientMachine = HV-CINDER-80696; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3020; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{2397F619-6D83-4C59-946E-95D56D5B7DA3}"; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	793	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	552	1356	hv-cinder-80696	S-1-5-18	9/15/2021 4:01:35 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {6F225088-7792-4CEE-97F0-B00C9DBB019A}; ClientMachine = HV-CINDER-80696; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3020; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=80238825; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	792	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	552	2288	hv-cinder-80696	S-1-5-18	9/15/2021 4:01:35 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {44EAE078-AD3B-479E-AF0F-CDE003A48BA7}; ClientMachine = HV-CINDER-80696; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3020; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=426360506; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	791	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	552	1356	hv-cinder-80696	S-1-5-18	9/15/2021 4:01:34 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {4543FE6D-896B-4941-9270-5A1324F9B8D2}; ClientMachine = HV-CINDER-80696; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3020; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1092062153; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	790	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	552	5100	hv-cinder-80696	S-1-5-18	9/15/2021 4:01:34 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {186D9390-CF95-4C0C-BBDF-468AC3C3CFC4}; ClientMachine = HV-CINDER-80696; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3020; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1640252054; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	789	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	552	1356	hv-cinder-80696	S-1-5-18	9/15/2021 4:01:20 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {B3834CD8-1A55-4C95-9550-B70123712DC4}; ClientMachine = HV-CINDER-80696; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3020; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=2002009870; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	788	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	552	2288	hv-cinder-80696	S-1-5-18	9/15/2021 4:01:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {18D2343B-DBE6-4B6B-9F52-DEC1FC9C59ED}; ClientMachine = HV-CINDER-80696; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3020; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=991220447; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	787	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	552	2288	hv-cinder-80696	S-1-5-18	9/15/2021 4:01:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {AAB32A79-9893-486E-99C8-AB04C43A42E8}; ClientMachine = HV-CINDER-80696; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3020; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1632558980; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	786	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	552	2940	hv-cinder-80696	S-1-5-18	9/15/2021 4:01:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {8ECFF485-9D33-4EF1-9999-20670594D561}; ClientMachine = HV-CINDER-80696; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3020; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Host.HostName="iqn.2010-10.org.openstack:volume-a3aba237-aa2c-43ed-af15-386ee1a06948"; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	785	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	552	2288	hv-cinder-80696	S-1-5-18	9/15/2021 4:01:16 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {E9FA1BA3-E80A-4AEF-8205-74979B3B1C1E}; ClientMachine = HV-CINDER-80696; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3020; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Host.HostName="iqn.2010-10.org.openstack:volume-c177787d-ab82-4adb-ae09-0344226395c3"; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	784	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	552	2288	hv-cinder-80696	S-1-5-18	9/15/2021 4:01:16 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {A692F3A9-75B6-4D0D-8768-D9F39F66ED0B}; ClientMachine = HV-CINDER-80696; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3020; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Host.HostName="iqn.2010-10.org.openstack:volume-a9bf935d-3583-4660-ba8b-984cb29aece7"; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	783	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	552	2940	hv-cinder-80696	S-1-5-18	9/15/2021 4:01:16 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
MSVSS__PROVIDER provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4804; ProviderPath = %systemroot%\system32\wbem\vsswmi.dll	5857	0	4611686018427387904	782	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	4804	1460	hv-cinder-80696	S-1-5-20	9/15/2021 4:01:16 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {31BA9D1C-31FB-4670-B269-D309D0160A3F}; ClientMachine = HV-CINDER-80696; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3020; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Host.HostName="iqn.2010-10.org.openstack:volume-add90d7e-e1f2-47af-a616-6e4c5c817d2b"; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	781	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	552	2940	hv-cinder-80696	S-1-5-18	9/15/2021 4:01:15 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {3C8A678C-4C84-4EE1-AF5E-EA6590366238}; ClientMachine = HV-CINDER-80696; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3020; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{AC56940C-83BE-4D46-956D-9866693B208A}"; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	780	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	552	2940	hv-cinder-80696	S-1-5-18	9/15/2021 4:01:15 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {2A238E66-7144-4A73-BDEC-97CE5440B5C1}; ClientMachine = HV-CINDER-80696; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3020; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_IDMethod.HostName="iqn.2010-10.org.openstack:volume-a3aba237-aa2c-43ed-af15-386ee1a06948",Method=4,Value="iqn.1991-05.com.microsoft:hv-cinder-80696"; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	779	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	552	2288	hv-cinder-80696	S-1-5-18	9/15/2021 4:01:15 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {A5BED556-A99F-4D34-A7D7-FCF33F21F218}; ClientMachine = HV-CINDER-80696; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3020; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_IDMethod.HostName="iqn.2010-10.org.openstack:volume-c177787d-ab82-4adb-ae09-0344226395c3",Method=4,Value="iqn.1991-05.com.microsoft:hv-cinder-80696"; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	778	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	552	2940	hv-cinder-80696	S-1-5-18	9/15/2021 4:01:15 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {A66B7830-D2ED-4C54-AD68-EB0B0082D452}; ClientMachine = HV-CINDER-80696; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3020; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_IDMethod.HostName="iqn.2010-10.org.openstack:volume-a9bf935d-3583-4660-ba8b-984cb29aece7",Method=4,Value="iqn.1991-05.com.microsoft:hv-cinder-80696"; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	777	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	552	2940	hv-cinder-80696	S-1-5-18	9/15/2021 4:01:15 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {429289A8-9D72-45CF-9AA9-B60A1BB9DF7F}; ClientMachine = HV-CINDER-80696; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3020; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_IDMethod.HostName="iqn.2010-10.org.openstack:volume-add90d7e-e1f2-47af-a616-6e4c5c817d2b",Method=4,Value="iqn.1991-05.com.microsoft:hv-cinder-80696"; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	776	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	552	2288	hv-cinder-80696	S-1-5-18	9/15/2021 4:01:15 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WMIProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2316; ProviderPath = %systemroot%\system32\wbem\wmiprov.dll	5857	0	4611686018427387904	775	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2316	2404	hv-cinder-80696	S-1-5-18	9/15/2021 4:01:15 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {464547B7-D53A-41BE-8502-11AAE5098A0D}; ClientMachine = HV-CINDER-80696; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3020; Component = Unknown; Operation = Start IWbemServices::ExecMethod - root\wmi : WT_Snapshot::Create; ResultCode = 0x800705B4; PossibleCause = Unknown	5858	2	4611686018427387904	774	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	552	2940	hv-cinder-80696	S-1-5-18	9/15/2021 4:01:14 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4804; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll	5857	0	4611686018427387904	773	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	4804	1460	hv-cinder-80696	S-1-5-20	9/15/2021 4:00:30 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4804; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll	5857	0	4611686018427387904	772	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	4804	1460	hv-cinder-80696	S-1-5-20	9/15/2021 3:58:28 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4804; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll	5857	0	4611686018427387904	771	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	4804	1460	hv-cinder-80696	S-1-5-20	9/15/2021 3:57:28 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4804; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll	5857	0	4611686018427387904	770	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	4804	1460	hv-cinder-80696	S-1-5-20	9/15/2021 3:54:26 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4804; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll	5857	0	4611686018427387904	769	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	4804	1460	hv-cinder-80696	S-1-5-20	9/15/2021 3:53:24 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4804; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll	5857	0	4611686018427387904	768	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	4804	1460	hv-cinder-80696	S-1-5-20	9/15/2021 3:52:23 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {C2DC4582-7EE2-47F4-807D-477781BD0CF1}; ClientMachine = HV-CINDER-80696; User = NT AUTHORITY\SYSTEM; ClientProcessId = 2008; Component = Unknown; Operation = Start IWbemServices::GetObject - root\virtualization\v2 : \\.\ROOT\virtualization\v2:Msvm_VirtualSystemSettingData.InstanceID="Microsoft:F4CC748F-91B2-451C-8F93-DFB29062349C"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	767	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	552	1356	hv-cinder-80696	S-1-5-18	9/15/2021 3:51:38 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4804; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll	5857	0	4611686018427387904	766	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	4804	1460	hv-cinder-80696	S-1-5-20	9/15/2021 3:51:23 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4804; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll	5857	0	4611686018427387904	765	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	4804	1460	hv-cinder-80696	S-1-5-20	9/15/2021 3:49:21 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
StorageWMI provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4804; ProviderPath = %SystemRoot%\System32\storagewmi.dll	5857	0	4611686018427387904	764	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	4804	1460	hv-cinder-80696	S-1-5-20	9/15/2021 3:48:13 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4804; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll	5857	0	4611686018427387904	763	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	4804	1460	hv-cinder-80696	S-1-5-20	9/15/2021 3:47:19 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4804; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll	5857	0	4611686018427387904	762	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	4804	1460	hv-cinder-80696	S-1-5-20	9/15/2021 3:46:16 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
StorageWMI provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4804; ProviderPath = %SystemRoot%\System32\storagewmi.dll	5857	0	4611686018427387904	761	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	4804	1460	hv-cinder-80696	S-1-5-20	9/15/2021 3:44:22 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {4AC7546F-3089-4939-BB93-D97ACE235340}; ClientMachine = HV-CINDER-80696; User = NT AUTHORITY\SYSTEM; ClientProcessId = 2008; Component = Unknown; Operation = Start IWbemServices::GetObject - root\virtualization\v2 : \\.\ROOT\virtualization\v2:Msvm_VirtualSystemSettingData.InstanceID="Microsoft:6EE6ED0C-850E-46CD-A20A-D1FD42DAF20C"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	760	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	552	1356	hv-cinder-80696	S-1-5-18	9/15/2021 3:44:21 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {AFA2A02F-13AB-47E9-8134-172810C9CA31}; ClientMachine = HV-CINDER-80696; User = NT AUTHORITY\SYSTEM; ClientProcessId = 2008; Component = Unknown; Operation = Start IWbemServices::GetObject - root\virtualization\v2 : \\.\ROOT\virtualization\v2:Msvm_VirtualSystemSettingData.InstanceID="Microsoft:7B4376E0-EEB5-4DDE-AA43-800C3D481318"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	759	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	552	2940	hv-cinder-80696	S-1-5-18	9/15/2021 3:44:21 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
StorageWMI provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4804; ProviderPath = %SystemRoot%\System32\storagewmi.dll	5857	0	4611686018427387904	758	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	4804	1460	hv-cinder-80696	S-1-5-20	9/15/2021 3:42:20 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
StorageWMI provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4804; ProviderPath = %SystemRoot%\System32\storagewmi.dll	5857	0	4611686018427387904	757	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	4804	1460	hv-cinder-80696	S-1-5-20	9/15/2021 3:36:19 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
StorageWMI provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4804; ProviderPath = %SystemRoot%\System32\storagewmi.dll	5857	0	4611686018427387904	756	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	4804	1460	hv-cinder-80696	S-1-5-20	9/15/2021 3:34:19 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
StorageWMI provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4804; ProviderPath = %SystemRoot%\System32\storagewmi.dll	5857	0	4611686018427387904	755	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	4804	1460	hv-cinder-80696	S-1-5-20	9/15/2021 3:32:18 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {912A1674-96B8-44E3-9C55-94786BE36AC5}; ClientMachine = HV-CINDER-80696; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3020; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=263915804; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	754	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	552	3004	hv-cinder-80696	S-1-5-18	9/15/2021 3:30:01 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {8F7053CA-3867-4429-BFCE-B0EE0D29470E}; ClientMachine = HV-CINDER-80696; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3020; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1097192918; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	753	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	552	1356	hv-cinder-80696	S-1-5-18	9/15/2021 3:30:00 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {A1DAB2C6-CB83-40B2-AE17-72C66EE7982B}; ClientMachine = HV-CINDER-80696; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3020; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{0030CD06-E6F0-4008-9A62-B248BAD285AE}"; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	752	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	552	1356	hv-cinder-80696	S-1-5-18	9/15/2021 3:29:59 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9E0B6856-4384-4DBD-A6A8-6CD3880494EF}; ClientMachine = HV-CINDER-80696; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3020; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=799611880; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	751	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	552	1160	hv-cinder-80696	S-1-5-18	9/15/2021 3:29:50 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {0E8F74FD-15E0-465E-8D7C-47370755279C}; ClientMachine = HV-CINDER-80696; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3020; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1675876448; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	750	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	552	2188	hv-cinder-80696	S-1-5-18	9/15/2021 3:29:49 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {5DF1174E-E708-4604-AD48-531BCD77CCCA}; ClientMachine = HV-CINDER-80696; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3020; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Host.HostName="iqn.2010-10.org.openstack:volume-207fbbc2-22a9-4e45-bdc9-c045faa4a44d"; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	749	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	552	1356	hv-cinder-80696	S-1-5-18	9/15/2021 3:29:48 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {57DE4934-FF75-492E-8F3E-71EF7E11EEAF}; ClientMachine = HV-CINDER-80696; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3020; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_IDMethod.HostName="iqn.2010-10.org.openstack:volume-207fbbc2-22a9-4e45-bdc9-c045faa4a44d",Method=4,Value="iqn.1991-05.com.microsoft:hv-cinder-80696"; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	748	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	552	2940	hv-cinder-80696	S-1-5-18	9/15/2021 3:29:48 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {DABBA341-F2A2-403D-96CF-0C9A2F17DF3B}; ClientMachine = HV-CINDER-80696; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3020; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{CB2AA961-B7C0-4230-BE4D-F596318369BC}"; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	747	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	552	2940	hv-cinder-80696	S-1-5-18	9/15/2021 3:29:40 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {8C684B91-B465-41FC-9176-B54FFEB79947}; ClientMachine = HV-CINDER-80696; User = NT AUTHORITY\SYSTEM; ClientProcessId = 2008; Component = Unknown; Operation = Start IWbemServices::GetObject - root\virtualization\v2 : \\.\ROOT\virtualization\v2:Msvm_VirtualSystemSettingData.InstanceID="Microsoft:D968D71D-F336-449B-8E6C-0A554A8C065D"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	746	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	552	1160	hv-cinder-80696	S-1-5-18	9/15/2021 3:29:34 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {B9439897-38FD-4C5D-A9B6-6334CCCB70BA}; ClientMachine = HV-CINDER-80696; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3020; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=76864697; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	745	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	552	1108	hv-cinder-80696	S-1-5-18	9/15/2021 3:29:29 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {0D7F4832-1799-492B-B2A0-064FB0254D4F}; ClientMachine = HV-CINDER-80696; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3020; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=250577451; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	744	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	552	4044	hv-cinder-80696	S-1-5-18	9/15/2021 3:29:24 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {27E5BA11-E338-4E28-8D04-465D77FA5810}; ClientMachine = HV-CINDER-80696; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3020; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=958333904; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	743	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	552	1160	hv-cinder-80696	S-1-5-18	9/15/2021 3:29:23 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {F9AB3185-ADFE-4469-83FE-12EF59A59CE6}; ClientMachine = HV-CINDER-80696; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3020; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1135965635; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	742	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	552	1160	hv-cinder-80696	S-1-5-18	9/15/2021 3:29:22 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {E8F99ED3-B469-4990-9C2A-9A8AAFDC941E}; ClientMachine = HV-CINDER-80696; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3020; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1194306068; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	741	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	552	1160	hv-cinder-80696	S-1-5-18	9/15/2021 3:29:21 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {8AF90EB6-80B1-4888-B2AA-B327ACE9496C}; ClientMachine = HV-CINDER-80696; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3020; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{907B4CA0-0423-4AE3-98F4-E6DC19EA914B}"; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	740	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	552	2188	hv-cinder-80696	S-1-5-18	9/15/2021 3:29:20 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9ECC6456-5E09-437E-A27E-A5B2FA2413C1}; ClientMachine = HV-CINDER-80696; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3020; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1559379105; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	739	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	552	4044	hv-cinder-80696	S-1-5-18	9/15/2021 3:29:20 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {C7B2B7AD-CAAE-4062-9E97-746658FDF737}; ClientMachine = HV-CINDER-80696; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3020; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Host.HostName="iqn.2010-10.org.openstack:volume-ea5d4d0c-3b3a-4166-ac2d-d6f4610a7102"; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	738	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	552	2940	hv-cinder-80696	S-1-5-18	9/15/2021 3:29:16 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {CAAF3FCB-69F7-4DAD-B857-A980450F01F4}; ClientMachine = HV-CINDER-80696; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3020; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_IDMethod.HostName="iqn.2010-10.org.openstack:volume-ea5d4d0c-3b3a-4166-ac2d-d6f4610a7102",Method=4,Value="iqn.1991-05.com.microsoft:hv-cinder-80696"; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	737	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	552	2940	hv-cinder-80696	S-1-5-18	9/15/2021 3:29:16 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {056F147C-F9C4-4B3F-877E-BF158A857B56}; ClientMachine = HV-CINDER-80696; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3020; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Host.HostName="iqn.2010-10.org.openstack:volume-7de5e096-4b4a-49f3-b092-01c6c839590d"; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	736	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	552	4044	hv-cinder-80696	S-1-5-18	9/15/2021 3:29:13 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {6E354C1F-F0E2-4BF0-972F-11364558D6C6}; ClientMachine = HV-CINDER-80696; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3020; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_IDMethod.HostName="iqn.2010-10.org.openstack:volume-7de5e096-4b4a-49f3-b092-01c6c839590d",Method=4,Value="iqn.1991-05.com.microsoft:hv-cinder-80696"; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	735	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	552	2940	hv-cinder-80696	S-1-5-18	9/15/2021 3:29:13 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {59EFE7DA-DEE6-43D9-83E5-56A2B2C1982D}; ClientMachine = HV-CINDER-80696; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3020; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{47298248-3618-41C2-B15F-9471EE2EE4CC}"; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	734	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	552	2940	hv-cinder-80696	S-1-5-18	9/15/2021 3:29:13 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {73ECBB0E-5500-4ABA-9513-2D41DA378673}; ClientMachine = HV-CINDER-80696; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3020; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=836672883; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	733	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	552	2940	hv-cinder-80696	S-1-5-18	9/15/2021 3:29:12 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {5FCD3495-CD95-425A-8E95-5AC1A9673940}; ClientMachine = HV-CINDER-80696; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3020; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{BBB10870-69D0-495B-9C36-4397E3904059}"; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	732	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	552	4044	hv-cinder-80696	S-1-5-18	9/15/2021 3:28:59 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {26683965-1032-4028-A48E-48889DD3C535}; ClientMachine = HV-CINDER-80696; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3020; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{DAC8DB45-56EB-42F2-B4C4-9BDE6474185B}"; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	731	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	552	2940	hv-cinder-80696	S-1-5-18	9/15/2021 3:28:58 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {73E30E92-D9AE-46D1-B432-1EF51F4F322B}; ClientMachine = HV-CINDER-80696; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3020; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{51556E61-B802-4D0E-B45D-46CC73B547BC}"; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	730	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	552	4676	hv-cinder-80696	S-1-5-18	9/15/2021 3:28:57 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {E0572279-C3FD-4234-8DDC-AE55A4F8DF41}; ClientMachine = HV-CINDER-80696; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3020; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1219566283; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	729	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	552	84	hv-cinder-80696	S-1-5-18	9/15/2021 3:28:37 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {73ED0AF5-67EC-434C-A202-15EDE465F07A}; ClientMachine = HV-CINDER-80696; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3020; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{65055030-1537-41C4-BF3C-3916B1194053}"; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	728	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	552	84	hv-cinder-80696	S-1-5-18	9/15/2021 3:28:35 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {21A84C5F-35EA-44C8-BFB6-1871123FAD9F}; ClientMachine = HV-CINDER-80696; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3020; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1399743567; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	727	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	552	4044	hv-cinder-80696	S-1-5-18	9/15/2021 3:28:12 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {C3F93705-56CF-498A-AF50-EA667E906D7C}; ClientMachine = HV-CINDER-80696; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3020; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1790017457; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	726	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	552	1108	hv-cinder-80696	S-1-5-18	9/15/2021 3:28:11 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96BDA1D8-D025-4F10-B176-E05CDAF6D412}; ClientMachine = HV-CINDER-80696; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3020; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Host.HostName="iqn.2010-10.org.openstack:volume-87e9d50b-2b25-4188-91b1-e1546a8479e2"; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	725	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	552	4044	hv-cinder-80696	S-1-5-18	9/15/2021 3:28:07 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00306162-6CC1-40AC-AE76-D78DE4816AEE}; ClientMachine = HV-CINDER-80696; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3020; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_IDMethod.HostName="iqn.2010-10.org.openstack:volume-87e9d50b-2b25-4188-91b1-e1546a8479e2",Method=4,Value="iqn.1991-05.com.microsoft:hv-cinder-80696"; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	724	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	552	4044	hv-cinder-80696	S-1-5-18	9/15/2021 3:28:07 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {C642155F-5464-458D-9D3A-A15B1D3EE7C7}; ClientMachine = HV-CINDER-80696; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3020; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=651085631; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	723	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	552	4112	hv-cinder-80696	S-1-5-18	9/15/2021 3:28:05 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {1A0A3A9A-F965-4479-BA7F-6E622BBF0AAB}; ClientMachine = HV-CINDER-80696; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3020; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=113205191; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	722	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	552	5100	hv-cinder-80696	S-1-5-18	9/15/2021 3:27:55 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {E0ED6FFE-E859-41EB-B282-88C491080FE7}; ClientMachine = HV-CINDER-80696; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3020; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=820160612; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	721	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	552	1108	hv-cinder-80696	S-1-5-18	9/15/2021 3:27:54 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {6877B856-E557-4E97-969E-BF74FBDC0330}; ClientMachine = HV-CINDER-80696; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3020; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=672692080; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	720	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	552	1108	hv-cinder-80696	S-1-5-18	9/15/2021 3:27:53 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {06F287A9-6DF2-43BA-B135-86206EAEFCAF}; ClientMachine = HV-CINDER-80696; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3020; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=329573864; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	719	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	552	1108	hv-cinder-80696	S-1-5-18	9/15/2021 3:27:53 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {B9D7BB20-FEF0-481D-9EDC-7406E5E9B331}; ClientMachine = HV-CINDER-80696; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3020; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1317500211; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	718	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	552	4112	hv-cinder-80696	S-1-5-18	9/15/2021 3:27:39 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {22F0B420-DF4F-499B-9805-597495ED2FF5}; ClientMachine = HV-CINDER-80696; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3020; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=342885110; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	717	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	552	2336	hv-cinder-80696	S-1-5-18	9/15/2021 3:27:33 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {771EFA5B-14A2-4E19-9640-6993C9A59A17}; ClientMachine = HV-CINDER-80696; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3020; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1109479740; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	716	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	552	2232	hv-cinder-80696	S-1-5-18	9/15/2021 3:27:33 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {4C5490C3-6E57-4F6A-B1DE-84859A01A382}; ClientMachine = HV-CINDER-80696; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3020; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{45158C08-C241-4E03-AB70-EDBC4C82060E}"; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	715	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	552	4676	hv-cinder-80696	S-1-5-18	9/15/2021 3:27:32 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {4E4F6454-2B47-4C67-983E-233A7DCF8C37}; ClientMachine = HV-CINDER-80696; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3020; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=65788988; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	714	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	552	2232	hv-cinder-80696	S-1-5-18	9/15/2021 3:27:32 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {ED295CFD-AA46-494B-84F2-D2571C15B77A}; ClientMachine = HV-CINDER-80696; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3020; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=52123992; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	713	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	552	2232	hv-cinder-80696	S-1-5-18	9/15/2021 3:27:32 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {C183A630-DF0D-4440-9B2B-03F576669570}; ClientMachine = HV-CINDER-80696; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3020; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1304560141; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	712	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	552	2336	hv-cinder-80696	S-1-5-18	9/15/2021 3:27:27 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {942F47EE-F0EF-4E87-B100-3D94A467FD97}; ClientMachine = HV-CINDER-80696; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3020; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1803189440; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	711	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	552	4044	hv-cinder-80696	S-1-5-18	9/15/2021 3:27:26 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {AB87C6C7-E043-4A01-9B9D-3F2EAA34A12A}; ClientMachine = HV-CINDER-80696; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3020; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{D3E8DBEC-D951-41EB-8671-AF3E6042036C}"; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	710	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	552	2232	hv-cinder-80696	S-1-5-18	9/15/2021 3:27:26 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {A1133A31-269C-4821-939E-68C5A827D154}; ClientMachine = HV-CINDER-80696; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3020; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1679200191; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	709	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	552	4044	hv-cinder-80696	S-1-5-18	9/15/2021 3:27:25 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {950BFCEB-A9C9-42B9-A2D8-AFF6BEC75532}; ClientMachine = HV-CINDER-80696; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3020; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=840092154; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	708	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	552	2232	hv-cinder-80696	S-1-5-18	9/15/2021 3:27:23 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {1325CA2A-A79D-4FE4-98EF-528C650685CA}; ClientMachine = HV-CINDER-80696; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3020; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=508619649; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	707	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	552	5100	hv-cinder-80696	S-1-5-18	9/15/2021 3:27:20 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {3E7718CB-ADED-4F60-B038-7A34B76F09D5}; ClientMachine = HV-CINDER-80696; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3020; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=346213966; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	706	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	552	2232	hv-cinder-80696	S-1-5-18	9/15/2021 3:27:18 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {6FBDD89C-F186-4A1E-84DF-5800B551E531}; ClientMachine = HV-CINDER-80696; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3020; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Host.HostName="iqn.2010-10.org.openstack:volume-9bffdd09-3daf-4df5-8041-d7d78775a926"; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	705	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	552	4044	hv-cinder-80696	S-1-5-18	9/15/2021 3:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FA9E45B9-2B3B-48C4-A40D-04AD2598C8F5}; ClientMachine = HV-CINDER-80696; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3020; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_IDMethod.HostName="iqn.2010-10.org.openstack:volume-9bffdd09-3daf-4df5-8041-d7d78775a926",Method=4,Value="iqn.1991-05.com.microsoft:hv-cinder-80696"; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	704	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	552	5100	hv-cinder-80696	S-1-5-18	9/15/2021 3:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {86E1007A-AB76-4A5E-8AA3-E005D7AD96BA}; ClientMachine = HV-CINDER-80696; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3020; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=980004353; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	703	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	552	4044	hv-cinder-80696	S-1-5-18	9/15/2021 3:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {65F814FF-6217-44B9-8B29-0890D0C583DB}; ClientMachine = HV-CINDER-80696; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3020; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{00D1C1CC-3B38-4E91-9E42-4077696D6326}"; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	702	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	552	5100	hv-cinder-80696	S-1-5-18	9/15/2021 3:27:16 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {84A93A26-5BC6-432D-8370-E3087D548D9F}; ClientMachine = HV-CINDER-80696; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3020; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{A49AADBD-B0E4-4F31-A7B5-4AAD5778E8E4}"; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	701	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	552	1160	hv-cinder-80696	S-1-5-18	9/15/2021 3:27:16 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {36ED65A2-BD22-412F-90F1-5D1955B15F84}; ClientMachine = HV-CINDER-80696; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3020; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=603484093; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	700	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	552	1160	hv-cinder-80696	S-1-5-18	9/15/2021 3:27:15 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {EFF98FF9-F038-4F15-9150-84CE5D6EE3F3}; ClientMachine = HV-CINDER-80696; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3020; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=220900525; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	699	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	552	2336	hv-cinder-80696	S-1-5-18	9/15/2021 3:27:10 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {45C2859B-5F42-4966-8B42-15853D63344C}; ClientMachine = HV-CINDER-80696; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3020; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{A048660B-B0DC-4143-97C0-59C6674DCC3C}"; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	698	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	552	2336	hv-cinder-80696	S-1-5-18	9/15/2021 3:27:06 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {468C45DF-898F-4153-998B-855587FE9068}; ClientMachine = HV-CINDER-80696; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3020; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=571451295; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	697	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	552	2336	hv-cinder-80696	S-1-5-18	9/15/2021 3:27:06 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {AA72570E-941B-4A68-B6A1-E375014B9928}; ClientMachine = HV-CINDER-80696; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3020; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{95302ED4-A2B6-439F-9C3F-222098CE0F32}"; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	696	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	552	2336	hv-cinder-80696	S-1-5-18	9/15/2021 3:27:01 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {46BAB6F9-70A1-48D9-B6E6-833C06449658}; ClientMachine = HV-CINDER-80696; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3020; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=2063089471; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	695	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	552	1108	hv-cinder-80696	S-1-5-18	9/15/2021 3:27:01 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {74F19CA9-3C8F-436E-8AE7-3BC421C037EF}; ClientMachine = HV-CINDER-80696; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3020; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{9616223C-80E8-471F-A254-E9B81A192688}"; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	694	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	552	5100	hv-cinder-80696	S-1-5-18	9/15/2021 3:26:59 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {111F976D-1029-4123-8175-AAAC0B266202}; ClientMachine = HV-CINDER-80696; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3020; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1159730144; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	693	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	552	2232	hv-cinder-80696	S-1-5-18	9/15/2021 3:26:55 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {F1993340-3789-49CC-BD07-B6DC1578BF5B}; ClientMachine = HV-CINDER-80696; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3020; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=500646484; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	692	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	552	4044	hv-cinder-80696	S-1-5-18	9/15/2021 3:26:55 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
StorageWMI provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4804; ProviderPath = %SystemRoot%\System32\storagewmi.dll	5857	0	4611686018427387904	691	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	4804	1460	hv-cinder-80696	S-1-5-20	9/15/2021 3:26:54 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {784DD307-3D45-48A8-8006-F422553CBE3A}; ClientMachine = HV-CINDER-80696; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3020; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{B3F11189-CC00-4E8F-8560-EB194A57DFA0}"; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	690	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	552	2188	hv-cinder-80696	S-1-5-18	9/15/2021 3:26:54 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {81BB66B2-6AE7-46BE-B70F-4F65920D0B4A}; ClientMachine = HV-CINDER-80696; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3020; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1535150621; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	689	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	552	5100	hv-cinder-80696	S-1-5-18	9/15/2021 3:26:53 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {ADECEC6C-A549-4A38-B9D5-51011D2A51A5}; ClientMachine = HV-CINDER-80696; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3020; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{3A94B50C-5339-46FF-B4A2-5E639FB3B327}"; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	688	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	552	1160	hv-cinder-80696	S-1-5-18	9/15/2021 3:26:53 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {B343CBAB-DB36-43DA-89E3-524B6607D4FC}; ClientMachine = HV-CINDER-80696; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3020; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{97C91704-884F-4BCC-8238-CB4595C26A66}"; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	687	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	552	1160	hv-cinder-80696	S-1-5-18	9/15/2021 3:26:53 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {F5981B24-90C9-4B34-A9DD-4A5DE9941168}; ClientMachine = HV-CINDER-80696; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3020; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{23649B5E-4278-4075-9F9F-F9A187C61381}"; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	686	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	552	2336	hv-cinder-80696	S-1-5-18	9/15/2021 3:26:46 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {4667C1B9-E5EF-4A82-BBB2-74F314525EDA}; ClientMachine = HV-CINDER-80696; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3020; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{032E8FBB-E3A4-4E7D-A6ED-BD759903BCD3}"; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	685	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	552	4044	hv-cinder-80696	S-1-5-18	9/15/2021 3:26:45 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {77CE1D4E-FB8C-48CC-B5F7-51E660EC356C}; ClientMachine = HV-CINDER-80696; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3020; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{12BE2F00-4A22-4B23-96B5-571ED655E83A}"; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	684	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	552	2336	hv-cinder-80696	S-1-5-18	9/15/2021 3:26:34 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {630B747F-5FE1-4157-BEA2-DAAA47B0BEC5}; ClientMachine = HV-CINDER-80696; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3020; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=2092348320; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	683	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	552	4112	hv-cinder-80696	S-1-5-18	9/15/2021 3:26:27 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {59E2C6FB-0C07-4F64-AD62-F0C3C1D778EC}; ClientMachine = HV-CINDER-80696; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3020; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1505782054; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	682	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	552	4112	hv-cinder-80696	S-1-5-18	9/15/2021 3:26:24 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {0C138841-943D-4F45-9348-1439FD8CA4E0}; ClientMachine = HV-CINDER-80696; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3020; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1029131725; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	681	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	552	2940	hv-cinder-80696	S-1-5-18	9/15/2021 3:26:24 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {EBD1200B-C67F-4574-9A6A-1A6478937D01}; ClientMachine = HV-CINDER-80696; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3020; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=918899556; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	680	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	552	4044	hv-cinder-80696	S-1-5-18	9/15/2021 3:26:23 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {2CDA3D2A-5D38-4D0F-8D5C-D8CBB575A2B1}; ClientMachine = HV-CINDER-80696; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3020; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{F8BEFFCD-B1E7-42E8-8B53-4898A804A8BF}"; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	679	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	552	2940	hv-cinder-80696	S-1-5-18	9/15/2021 3:26:22 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {5FD30DD8-7209-412A-9C31-EE9C0F8F58A9}; ClientMachine = HV-CINDER-80696; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3020; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=527963269; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	678	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	552	4648	hv-cinder-80696	S-1-5-18	9/15/2021 3:26:22 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {1950A3E0-62B6-4C09-BA6E-70E86EE05BC8}; ClientMachine = HV-CINDER-80696; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3020; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1792477733; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	677	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	552	2940	hv-cinder-80696	S-1-5-18	9/15/2021 3:26:21 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {2C0A6DB6-03F8-443D-8A48-7C5D98A30B97}; ClientMachine = HV-CINDER-80696; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3020; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1916412699; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	676	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	552	4648	hv-cinder-80696	S-1-5-18	9/15/2021 3:26:20 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {56187CD3-C48B-4315-AE4B-995C65E5079C}; ClientMachine = HV-CINDER-80696; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3020; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{34C5E7AE-88F6-449F-9CD1-6E5FF9D3D970}"; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	675	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	552	1160	hv-cinder-80696	S-1-5-18	9/15/2021 3:26:19 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {20EE3EAF-E9B7-4639-86CC-EF1C0AACE9EC}; ClientMachine = HV-CINDER-80696; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3020; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1503655413; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	674	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	552	2940	hv-cinder-80696	S-1-5-18	9/15/2021 3:26:19 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {7A5F6549-39A5-4D42-8BE8-9875B1A44F86}; ClientMachine = HV-CINDER-80696; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3020; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=43430569; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	673	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	552	4648	hv-cinder-80696	S-1-5-18	9/15/2021 3:26:19 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {2A2C1C99-03AE-468D-B72A-8E19CB4F1B26}; ClientMachine = HV-CINDER-80696; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3020; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=630351177; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	672	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	552	3004	hv-cinder-80696	S-1-5-18	9/15/2021 3:26:03 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {79286222-D986-42AA-A0D3-2987F7743A37}; ClientMachine = HV-CINDER-80696; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3020; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=318293381; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	671	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	552	3004	hv-cinder-80696	S-1-5-18	9/15/2021 3:26:00 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
MSVSS__PROVIDER provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4804; ProviderPath = %systemroot%\system32\wbem\vsswmi.dll	5857	0	4611686018427387904	670	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	4804	1460	hv-cinder-80696	S-1-5-20	9/15/2021 3:25:59 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32a provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4804; ProviderPath = %systemroot%\system32\wbem\wmipcima.dll	5857	0	4611686018427387904	669	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	4804	4704	hv-cinder-80696	S-1-5-20	9/15/2021 3:25:59 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WinTargetProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 5036; ProviderPath = C:\windows\system32\wbem\WTWMIProv.dll	5857	0	4611686018427387904	668	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	5036	1140	hv-cinder-80696	S-1-5-19	9/15/2021 3:25:59 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2924; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll	5857	0	4611686018427387904	667	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2924	104	hv-cinder-80696	S-1-5-18	9/15/2021 3:24:33 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4804; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll	5857	0	4611686018427387904	666	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	4804	1460	hv-cinder-80696	S-1-5-20	9/15/2021 3:24:33 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WinTargetProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4736; ProviderPath = C:\windows\system32\wbem\WTWMIProv.dll	5857	0	4611686018427387904	665	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	4736	140	hv-cinder-80696	S-1-5-19	9/15/2021 3:24:08 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Namespace = root\virtualization\v2; NotificationQuery = SELECT * FROM __InstanceDeletionEvent WITHIN 2 WHERE TargetInstance ISA 'Msvm_SyntheticEthernetPortSettingData' ; UserName = NT AUTHORITY\SYSTEM; ClientProcessID = 2456, ClientMachine = HV-CINDER-80696; PossibleCause = Temporary	5860	0	4611686018427387904	664	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	552	4724	hv-cinder-80696	S-1-5-18	9/15/2021 3:24:06 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Namespace = root\virtualization\v2; NotificationQuery = SELECT * FROM __InstanceCreationEvent WITHIN 2 WHERE TargetInstance ISA 'Msvm_SyntheticEthernetPortSettingData' ; UserName = NT AUTHORITY\SYSTEM; ClientProcessID = 2456, ClientMachine = HV-CINDER-80696; PossibleCause = Temporary	5860	0	4611686018427387904	663	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	552	4724	hv-cinder-80696	S-1-5-18	9/15/2021 3:24:06 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Namespace = root\virtualization\v2; NotificationQuery = SELECT EnabledState, TargetInstance FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA 'Msvm_ComputerSystem' AND TargetInstance.EnabledState != PreviousInstance.EnabledState AND (TargetInstance.EnabledState = '2' OR TargetInstance.EnabledState = '3' OR TargetInstance.EnabledState = '32768' OR TargetInstance.EnabledState = '32769'); UserName = NT AUTHORITY\SYSTEM; ClientProcessID = 2008, ClientMachine = HV-CINDER-80696; PossibleCause = Temporary	5860	0	4611686018427387904	662	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	552	4724	hv-cinder-80696	S-1-5-18	9/15/2021 3:24:03 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WMIProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4392; ProviderPath = %systemroot%\system32\wbem\wmiprov.dll	5857	0	4611686018427387904	661	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	4392	4448	hv-cinder-80696	S-1-5-18	9/15/2021 3:24:01 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Win32_WIN32_TERMINALSERVICE_Prov provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4804; ProviderPath = %SystemRoot%\system32\tscfgwmi.dll	5857	0	4611686018427387904	660	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	4804	4116	hv-cinder-80696	S-1-5-20	9/15/2021 3:23:47 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2924; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll	5857	0	4611686018427387904	659	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2924	104	hv-cinder-80696	S-1-5-18	9/15/2021 3:23:37 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4804; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll	5857	0	4611686018427387904	658	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	4804	4116	hv-cinder-80696	S-1-5-20	9/15/2021 3:23:37 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4804; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll	5857	0	4611686018427387904	657	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	4804	4116	hv-cinder-80696	S-1-5-20	9/15/2021 3:23:37 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = HV-CINDER-80696; User = NT AUTHORITY\SYSTEM; ClientProcessId = 772; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\Microsoft\Windows\DeviceGuard : SELECT RequiredSecurityProperties FROM Win32_DeviceGuard ; ResultCode = 0x80041032; PossibleCause = Unknown	5858	2	4611686018427387904	656	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	552	1356	hv-cinder-80696	S-1-5-18	9/15/2021 3:22:09 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = HV-CINDER-80696; User = NT AUTHORITY\SYSTEM; ClientProcessId = 772; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\Microsoft\Windows\DeviceGuard : SELECT SecurityServicesConfigured FROM Win32_DeviceGuard ; ResultCode = 0x80041032; PossibleCause = Unknown	5858	2	4611686018427387904	655	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	552	1356	hv-cinder-80696	S-1-5-18	9/15/2021 3:22:09 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Win32_TpmProvider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4804; ProviderPath = C:\Windows\system32\wbem\Win32_TPM.dll	5857	0	4611686018427387904	654	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	4804	4116	hv-cinder-80696	S-1-5-20	9/15/2021 3:22:09 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = HV-CINDER-80696; User = NT AUTHORITY\SYSTEM; ClientProcessId = 772; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\Microsoft\Windows\DeviceGuard : SELECT SecurityServicesRunning FROM Win32_DeviceGuard ; ResultCode = 0x80041032; PossibleCause = Unknown	5858	2	4611686018427387904	653	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	552	3004	hv-cinder-80696	S-1-5-18	9/15/2021 3:22:09 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Win32_DeviceGuard provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4804; ProviderPath = %SystemRoot%\System32\Win32_DeviceGuard.dll	5857	0	4611686018427387904	652	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	4804	4116	hv-cinder-80696	S-1-5-20	9/15/2021 3:22:09 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = HV-CINDER-80696; User = NT AUTHORITY\SYSTEM; ClientProcessId = 772; Component = Unknown; Operation = Start IWbemServices::ExecQuery - ROOT\CIMV2 : select ChassisTypes from Win32_SystemEnclosure; ResultCode = 0x80041032; PossibleCause = Unknown	5858	2	4611686018427387904	651	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	552	3004	hv-cinder-80696	S-1-5-18	9/15/2021 3:22:08 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = HV-CINDER-80696; User = NT AUTHORITY\SYSTEM; ClientProcessId = 772; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\CIMV2 : SELECT SMBIOSAssetTag FROM Win32_SystemEnclosure ; ResultCode = 0x80041032; PossibleCause = Unknown	5858	2	4611686018427387904	650	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	552	3004	hv-cinder-80696	S-1-5-18	9/15/2021 3:22:08 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4804; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll	5857	0	4611686018427387904	649	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	4804	4116	hv-cinder-80696	S-1-5-20	9/15/2021 3:22:08 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1648; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll	5857	0	4611686018427387904	648	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	1648	2196	hv-cinder-80696	S-1-5-18	9/15/2021 3:22:08 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
ServerFeatureProvider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4804; ProviderPath = %windir%\system32\wbem\servercompprov.dll	5857	0	4611686018427387904	647	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	4804	4116	hv-cinder-80696	S-1-5-20	9/15/2021 3:22:07 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WMIProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4332; ProviderPath = %systemroot%\system32\wbem\wmiprov.dll	5857	0	4611686018427387904	646	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	4332	724	hv-cinder-80696	S-1-5-18	9/15/2021 3:15:24 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32a provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 140; ProviderPath = %systemroot%\system32\wbem\wmipcima.dll	5857	0	4611686018427387904	645	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	140	4072	hv-cinder-80696	S-1-5-20	9/15/2021 3:14:23 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Win32_WIN32_TERMINALSERVICE_Prov provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 140; ProviderPath = %SystemRoot%\system32\tscfgwmi.dll	5857	0	4611686018427387904	644	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	140	2552	hv-cinder-80696	S-1-5-20	9/15/2021 3:14:22 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 140; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll	5857	0	4611686018427387904	643	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	140	4072	hv-cinder-80696	S-1-5-20	9/15/2021 3:14:22 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
MSIProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 808; ProviderPath = %systemroot%\system32\wbem\msiprov.dll	5857	0	4611686018427387904	642	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	808	956	hv-cinder-80696	S-1-5-18	9/15/2021 2:54:27 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WMIProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 808; ProviderPath = %systemroot%\system32\wbem\wmiprov.dll	5857	0	4611686018427387904	641	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	808	956	hv-cinder-80696	S-1-5-18	9/15/2021 2:51:28 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WMIProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 808; ProviderPath = %systemroot%\system32\wbem\wmiprov.dll	5857	0	4611686018427387904	640	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	808	956	hv-cinder-80696	S-1-5-18	9/15/2021 2:51:28 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {22730B0C-A9DC-0000-CE0D-7322DCA9D701}; ClientMachine = HV-CINDER-80696; User = HV-CINDER-80696\Admin; ClientProcessId = 1044; Component = Core; Operation = Start IWbemServices::ExecNotificationQuery - root\virtualization\v2 : SELECT * FROM __InstanceDeletionEvent WITHIN 2 WHERE TargetInstance ISA 'Msvm_ConcreteJob'; ResultCode = 0x800706BE; PossibleCause = Could not send status to client	5858	2	4611686018427387904	639	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	552	1356	hv-cinder-80696	S-1-5-18	9/15/2021 2:50:53 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {22730B0C-A9DC-0000-CE0D-7322DCA9D701}; ClientMachine = HV-CINDER-80696; User = HV-CINDER-80696\Admin; ClientProcessId = 1044; Component = Unknown; Operation = Start IWbemServices::ExecNotificationQuery - root\virtualization\v2 : SELECT * FROM __InstanceDeletionEvent WITHIN 2 WHERE TargetInstance ISA 'Msvm_ConcreteJob'; ResultCode = 0x80041032; PossibleCause = Unknown	5858	2	4611686018427387904	638	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	552	2752	hv-cinder-80696	S-1-5-18	9/15/2021 2:50:53 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {22730B0C-A9DC-0000-CE0D-7322DCA9D701}; ClientMachine = HV-CINDER-80696; User = HV-CINDER-80696\Admin; ClientProcessId = 1044; Component = Unknown; Operation = Start IWbemServices::ExecNotificationQuery - root\virtualization\v2 : SELECT * FROM __InstanceModificationEvent WITHIN 2 WHERE TargetInstance ISA 'Msvm_ConcreteJob'; ResultCode = 0x80041032; PossibleCause = Unknown	5858	2	4611686018427387904	637	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	552	2752	hv-cinder-80696	S-1-5-18	9/15/2021 2:50:51 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Namespace = root\virtualization\v2; NotificationQuery = SELECT * FROM __InstanceDeletionEvent WITHIN 2 WHERE TargetInstance ISA 'Msvm_ConcreteJob'; UserName = HV-CINDER-80696\Admin; ClientProcessID = 1044, ClientMachine = HV-CINDER-80696; PossibleCause = Temporary	5860	0	4611686018427387904	636	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	552	2752	hv-cinder-80696	S-1-5-18	9/15/2021 2:50:51 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Namespace = root\virtualization\v2; NotificationQuery = SELECT * FROM __InstanceModificationEvent WITHIN 2 WHERE TargetInstance ISA 'Msvm_ConcreteJob'; UserName = HV-CINDER-80696\Admin; ClientProcessID = 1044, ClientMachine = HV-CINDER-80696; PossibleCause = Temporary	5860	0	4611686018427387904	635	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	552	2752	hv-cinder-80696	S-1-5-18	9/15/2021 2:50:51 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NetAdapterCim provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1448; ProviderPath = %systemroot%\system32\wbem\NetAdapterCim.dll	5857	0	4611686018427387904	634	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	1448	1704	hv-cinder-80696	S-1-5-19	9/15/2021 2:50:51 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
nettcpip provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2964; ProviderPath = %systemroot%\system32\wbem\NetTCPIP.dll	5857	0	4611686018427387904	633	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2964	3804	hv-cinder-80696	S-1-5-20	9/15/2021 2:50:49 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
MSiSCSITargetProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3192; ProviderPath = C:\windows\system32\wbem\SmIscsiTargetProv.dll	5857	0	4611686018427387904	632	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	3192	3116	hv-cinder-80696	S-1-5-20	9/15/2021 2:50:47 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WinTargetProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3868; ProviderPath = C:\windows\system32\wbem\WTWMIProv.dll	5857	0	4611686018427387904	631	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	3868	1484	hv-cinder-80696	S-1-5-19	9/15/2021 2:50:47 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WMIProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 808; ProviderPath = %systemroot%\system32\wbem\wmiprov.dll	5857	0	4611686018427387904	630	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	808	956	hv-cinder-80696	S-1-5-18	9/15/2021 2:50:47 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
MSiSCSITargetProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3192; ProviderPath = C:\windows\system32\wbem\SmIscsiTargetProv.dll	5857	0	4611686018427387904	629	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	3192	3756	hv-cinder-80696	S-1-5-20	9/15/2021 2:50:47 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Win32_WIN32_TERMINALSERVICE_Prov provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2964; ProviderPath = %SystemRoot%\system32\tscfgwmi.dll	5857	0	4611686018427387904	628	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2964	2988	hv-cinder-80696	S-1-5-20	9/15/2021 2:50:35 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
wfascim provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2964; ProviderPath = %systemroot%\system32\wbem\wfascim.dll	5857	0	4611686018427387904	627	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2964	2280	hv-cinder-80696	S-1-5-20	9/15/2021 2:50:32 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2964; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll	5857	0	4611686018427387904	626	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2964	2988	hv-cinder-80696	S-1-5-20	9/15/2021 2:50:00 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = HV-CINDER-80696; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3768; Component = Unknown; Operation = Start IWbemServices::CreateInstanceEnum - root\wmi : MSiSCSI_PortalInfoClass; ResultCode = 0x8004100C; PossibleCause = Unknown	5858	2	4611686018427387904	625	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	552	2924	hv-cinder-80696	S-1-5-18	9/15/2021 2:49:32 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = HV-CINDER-80696; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3768; Component = Unknown; Operation = Start IWbemServices::CreateInstanceEnum - root\wmi : MS_SM_AdapterInformationQuery; ResultCode = 0x8004100C; PossibleCause = Unknown	5858	2	4611686018427387904	624	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	552	2924	hv-cinder-80696	S-1-5-18	9/15/2021 2:49:32 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WMIProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 808; ProviderPath = %systemroot%\system32\wbem\wmiprov.dll	5857	0	4611686018427387904	623	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	808	956	hv-cinder-80696	S-1-5-18	9/15/2021 2:49:32 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = HV-CINDER-80696; User = HV-CINDER-80696\cloudbase-init; ClientProcessId = 2344; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\cimv2 : SELECT RemainingWindowsReArmCount, KeyManagementServiceListeningPort, KeyManagementServiceDnsPublishing, KeyManagementServiceLowPriority, ClientMachineId, KeyManagementServiceHostCaching, Version FROM SoftwareLicensingService; ResultCode = 0x80041032; PossibleCause = Unknown	5858	2	4611686018427387904	622	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	552	3036	hv-cinder-80696	S-1-5-18	9/15/2021 2:49:27 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
SppProvider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2964; ProviderPath = %SystemRoot%\System32\sppwmi.dll	5857	0	4611686018427387904	621	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2964	2992	hv-cinder-80696	S-1-5-20	9/15/2021 2:49:27 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = HV-CINDER-80696; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1316; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\Microsoft\Windows\DeviceGuard : SELECT AvailableSecurityProperties FROM Win32_DeviceGuard ; ResultCode = 0x80041032; PossibleCause = Unknown	5858	2	4611686018427387904	620	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	552	2236	hv-cinder-80696	S-1-5-18	9/15/2021 2:49:26 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Win32_TpmProvider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2964; ProviderPath = C:\Windows\system32\wbem\Win32_TPM.dll	5857	0	4611686018427387904	619	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2964	2992	hv-cinder-80696	S-1-5-20	9/15/2021 2:49:26 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = HV-CINDER-80696; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1316; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\Microsoft\Windows\DeviceGuard : SELECT VirtualizationBasedSecurityStatus FROM Win32_DeviceGuard ; ResultCode = 0x80041032; PossibleCause = Unknown	5858	2	4611686018427387904	618	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	552	2132	hv-cinder-80696	S-1-5-18	9/15/2021 2:49:26 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = HV-CINDER-80696; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1316; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\Microsoft\Windows\DeviceGuard : SELECT SecurityServicesRunning FROM Win32_DeviceGuard ; ResultCode = 0x80041032; PossibleCause = Unknown	5858	2	4611686018427387904	617	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	552	2236	hv-cinder-80696	S-1-5-18	9/15/2021 2:49:26 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = HV-CINDER-80696; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1316; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\Microsoft\Windows\DeviceGuard : SELECT SecurityServicesRunning FROM Win32_DeviceGuard ; ResultCode = 0x80041032; PossibleCause = Unknown	5858	2	4611686018427387904	616	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	552	2132	hv-cinder-80696	S-1-5-18	9/15/2021 2:49:26 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = HV-CINDER-80696; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1316; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\Microsoft\Windows\DeviceGuard : SELECT SecurityServicesRunning FROM Win32_DeviceGuard ; ResultCode = 0x80041032; PossibleCause = Unknown	5858	2	4611686018427387904	615	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	552	2132	hv-cinder-80696	S-1-5-18	9/15/2021 2:49:26 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Win32_DeviceGuard provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2964; ProviderPath = %SystemRoot%\System32\Win32_DeviceGuard.dll	5857	0	4611686018427387904	614	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2964	2992	hv-cinder-80696	S-1-5-20	9/15/2021 2:49:26 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = HV-CINDER-80696; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1316; Component = Unknown; Operation = Start IWbemServices::ExecQuery - ROOT\CIMV2 : select ChassisTypes from Win32_SystemEnclosure; ResultCode = 0x80041032; PossibleCause = Unknown	5858	2	4611686018427387904	613	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	552	3036	hv-cinder-80696	S-1-5-18	9/15/2021 2:49:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = HV-CINDER-80696; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1316; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\CIMV2 : SELECT SMBIOSAssetTag FROM Win32_SystemEnclosure ; ResultCode = 0x80041032; PossibleCause = Unknown	5858	2	4611686018427387904	612	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	552	2236	hv-cinder-80696	S-1-5-18	9/15/2021 2:49:16 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = HV-CINDER-80696; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1316; Component = Unknown; Operation = Start IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT ID FROM Win32_ServerFeature; ResultCode = 0x80041032; PossibleCause = Unknown	5858	2	4611686018427387904	611	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	552	3020	hv-cinder-80696	S-1-5-18	9/15/2021 2:49:08 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1352; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll	5857	0	4611686018427387904	610	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	1352	4028	hv-cinder-80696	S-1-5-18	9/15/2021 2:49:03 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
ServerFeatureProvider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2964; ProviderPath = %windir%\system32\wbem\servercompprov.dll	5857	0	4611686018427387904	609	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2964	2992	hv-cinder-80696	S-1-5-20	9/15/2021 2:49:03 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9838DD50-D1E2-4127-BE7B-B034A0C7164D}; ClientMachine = HV-CINDER-80696; User = ; ClientProcessId = 552; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{FC491EF1-C4AA-4CE1-B329-414B101DB823}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	608	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	552	2920	hv-cinder-80696	S-1-5-18	9/15/2021 2:48:49 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9838DD50-D1E2-4127-BE7B-B034A0C7164D}; ClientMachine = HV-CINDER-80696; User = ; ClientProcessId = 552; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{fbf687e6-f063-4d9f-9f4f-fd9a26acdd5f}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	607	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	552	2920	hv-cinder-80696	S-1-5-18	9/15/2021 2:48:49 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9838DD50-D1E2-4127-BE7B-B034A0C7164D}; ClientMachine = HV-CINDER-80696; User = ; ClientProcessId = 552; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{FB2CA36D-0B40-4307-821B-A13B252DE56C}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	606	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	552	2920	hv-cinder-80696	S-1-5-18	9/15/2021 2:48:49 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9838DD50-D1E2-4127-BE7B-B034A0C7164D}; ClientMachine = HV-CINDER-80696; User = ; ClientProcessId = 552; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{f3ccc681-b74c-4060-9f26-cd84525dca2a}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	605	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	552	2920	hv-cinder-80696	S-1-5-18	9/15/2021 2:48:49 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9838DD50-D1E2-4127-BE7B-B034A0C7164D}; ClientMachine = HV-CINDER-80696; User = ; ClientProcessId = 552; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{F312195E-3D9D-447A-A3F5-08DFFA24735E}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	604	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	552	2920	hv-cinder-80696	S-1-5-18	9/15/2021 2:48:49 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9838DD50-D1E2-4127-BE7B-B034A0C7164D}; ClientMachine = HV-CINDER-80696; User = ; ClientProcessId = 552; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{E62688F0-25FD-4c90-BFF5-F508B9D2E31F}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	603	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	552	2920	hv-cinder-80696	S-1-5-18	9/15/2021 2:48:49 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9838DD50-D1E2-4127-BE7B-B034A0C7164D}; ClientMachine = HV-CINDER-80696; User = ; ClientProcessId = 552; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{E5094040-C46C-4115-B030-04FB2E545B00}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	602	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	552	2920	hv-cinder-80696	S-1-5-18	9/15/2021 2:48:49 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9838DD50-D1E2-4127-BE7B-B034A0C7164D}; ClientMachine = HV-CINDER-80696; User = ; ClientProcessId = 552; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{E4F48E54-F38D-4884-BFB9-D4D2E5729C18}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	601	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	552	2920	hv-cinder-80696	S-1-5-18	9/15/2021 2:48:49 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9838DD50-D1E2-4127-BE7B-B034A0C7164D}; ClientMachine = HV-CINDER-80696; User = ; ClientProcessId = 552; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{e437bc1c-aa7d-11d2-a382-00c04f991e27}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	600	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	552	2920	hv-cinder-80696	S-1-5-18	9/15/2021 2:48:49 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9838DD50-D1E2-4127-BE7B-B034A0C7164D}; ClientMachine = HV-CINDER-80696; User = ; ClientProcessId = 552; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{CF7639F3-ABA2-41DB-97F2-81E2C5DBFC5D}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	599	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	552	2920	hv-cinder-80696	S-1-5-18	9/15/2021 2:48:49 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9838DD50-D1E2-4127-BE7B-B034A0C7164D}; ClientMachine = HV-CINDER-80696; User = ; ClientProcessId = 552; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{cdeafc3d-948d-49dd-ab12-e578ba4af7aa}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	598	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	552	2920	hv-cinder-80696	S-1-5-18	9/15/2021 2:48:49 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9838DD50-D1E2-4127-BE7B-B034A0C7164D}; ClientMachine = HV-CINDER-80696; User = ; ClientProcessId = 552; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{c6dc5466-785a-11d2-84d0-00c04fb169f7}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	597	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	552	2920	hv-cinder-80696	S-1-5-18	9/15/2021 2:48:49 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9838DD50-D1E2-4127-BE7B-B034A0C7164D}; ClientMachine = HV-CINDER-80696; User = ; ClientProcessId = 552; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{C631DF4C-088F-4156-B058-4375F0853CD8}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	596	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	552	2920	hv-cinder-80696	S-1-5-18	9/15/2021 2:48:49 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9838DD50-D1E2-4127-BE7B-B034A0C7164D}; ClientMachine = HV-CINDER-80696; User = ; ClientProcessId = 552; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{C418DD9D-0D14-4efb-8FBF-CFE535C8FAC7}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	595	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	552	2920	hv-cinder-80696	S-1-5-18	9/15/2021 2:48:49 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9838DD50-D1E2-4127-BE7B-B034A0C7164D}; ClientMachine = HV-CINDER-80696; User = ; ClientProcessId = 552; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{C34B2751-1CF4-44F5-9262-C3FC39666591}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	594	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	552	2920	hv-cinder-80696	S-1-5-18	9/15/2021 2:48:49 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9838DD50-D1E2-4127-BE7B-B034A0C7164D}; ClientMachine = HV-CINDER-80696; User = ; ClientProcessId = 552; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{BC75B1ED-5833-4858-9BB8-CBF0B166DF9D}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	593	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	552	2920	hv-cinder-80696	S-1-5-18	9/15/2021 2:48:49 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9838DD50-D1E2-4127-BE7B-B034A0C7164D}; ClientMachine = HV-CINDER-80696; User = ; ClientProcessId = 552; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{BA649533-0AAC-4E04-B9BC-4DBAE0325B12}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	592	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	552	2920	hv-cinder-80696	S-1-5-18	9/15/2021 2:48:49 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9838DD50-D1E2-4127-BE7B-B034A0C7164D}; ClientMachine = HV-CINDER-80696; User = ; ClientProcessId = 552; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{B587E2B1-4D59-4e7e-AED9-22B9DF11D053}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	591	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	552	2920	hv-cinder-80696	S-1-5-18	9/15/2021 2:48:49 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9838DD50-D1E2-4127-BE7B-B034A0C7164D}; ClientMachine = HV-CINDER-80696; User = ; ClientProcessId = 552; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{B087BE9D-ED37-454f-AF9C-04291E351182}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	590	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	552	2920	hv-cinder-80696	S-1-5-18	9/15/2021 2:48:49 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9838DD50-D1E2-4127-BE7B-B034A0C7164D}; ClientMachine = HV-CINDER-80696; User = ; ClientProcessId = 552; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{AADCED64-746C-4633-A97C-D61349046527}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	589	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	552	2920	hv-cinder-80696	S-1-5-18	9/15/2021 2:48:49 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9838DD50-D1E2-4127-BE7B-B034A0C7164D}; ClientMachine = HV-CINDER-80696; User = ; ClientProcessId = 552; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{A3F3E39B-5D83-4940-B954-28315B82F0A8}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	588	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	552	2920	hv-cinder-80696	S-1-5-18	9/15/2021 2:48:49 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9838DD50-D1E2-4127-BE7B-B034A0C7164D}; ClientMachine = HV-CINDER-80696; User = ; ClientProcessId = 552; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{91FBB303-0CD5-4055-BF42-E512A681B325}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	587	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	552	2920	hv-cinder-80696	S-1-5-18	9/15/2021 2:48:49 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9838DD50-D1E2-4127-BE7B-B034A0C7164D}; ClientMachine = HV-CINDER-80696; User = ; ClientProcessId = 552; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{8A28E2C5-8D06-49A4-A08C-632DAA493E17}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	586	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	552	2920	hv-cinder-80696	S-1-5-18	9/15/2021 2:48:49 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9838DD50-D1E2-4127-BE7B-B034A0C7164D}; ClientMachine = HV-CINDER-80696; User = ; ClientProcessId = 552; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{827D319E-6EAC-11D2-A4EA-00C04F79F83A}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	585	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	552	2920	hv-cinder-80696	S-1-5-18	9/15/2021 2:48:49 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9838DD50-D1E2-4127-BE7B-B034A0C7164D}; ClientMachine = HV-CINDER-80696; User = ; ClientProcessId = 552; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{7B849a69-220F-451E-B3FE-2CB811AF94AE}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	584	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	552	2920	hv-cinder-80696	S-1-5-18	9/15/2021 2:48:49 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9838DD50-D1E2-4127-BE7B-B034A0C7164D}; ClientMachine = HV-CINDER-80696; User = ; ClientProcessId = 552; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{7933F41E-56F8-41d6-A31C-4148A711EE93}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	583	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	552	2920	hv-cinder-80696	S-1-5-18	9/15/2021 2:48:49 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9838DD50-D1E2-4127-BE7B-B034A0C7164D}; ClientMachine = HV-CINDER-80696; User = ; ClientProcessId = 552; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{74EE6C03-5363-4554-B161-627540339CAB}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	582	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	552	2920	hv-cinder-80696	S-1-5-18	9/15/2021 2:48:49 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9838DD50-D1E2-4127-BE7B-B034A0C7164D}; ClientMachine = HV-CINDER-80696; User = ; ClientProcessId = 552; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{728EE579-943C-4519-9EF7-AB56765798ED}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	581	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	552	2920	hv-cinder-80696	S-1-5-18	9/15/2021 2:48:49 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9838DD50-D1E2-4127-BE7B-B034A0C7164D}; ClientMachine = HV-CINDER-80696; User = ; ClientProcessId = 552; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{7150F9BF-48AD-4da4-A49C-29EF4A8369BA}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	580	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	552	2920	hv-cinder-80696	S-1-5-18	9/15/2021 2:48:49 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9838DD50-D1E2-4127-BE7B-B034A0C7164D}; ClientMachine = HV-CINDER-80696; User = ; ClientProcessId = 552; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{6A4C88C6-C502-4f74-8F60-2CB23EDC24E2}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	579	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	552	2920	hv-cinder-80696	S-1-5-18	9/15/2021 2:48:49 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9838DD50-D1E2-4127-BE7B-B034A0C7164D}; ClientMachine = HV-CINDER-80696; User = ; ClientProcessId = 552; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{6232C319-91AC-4931-9385-E70C2B099F0E}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	578	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	552	2920	hv-cinder-80696	S-1-5-18	9/15/2021 2:48:49 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9838DD50-D1E2-4127-BE7B-B034A0C7164D}; ClientMachine = HV-CINDER-80696; User = ; ClientProcessId = 552; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{4CFB60C1-FAA6-47f1-89AA-0B18730C9FD3}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	577	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	552	2920	hv-cinder-80696	S-1-5-18	9/15/2021 2:48:49 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9838DD50-D1E2-4127-BE7B-B034A0C7164D}; ClientMachine = HV-CINDER-80696; User = ; ClientProcessId = 552; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{4bcd6cde-777b-48b6-9804-43568e23545d}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	576	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	552	2920	hv-cinder-80696	S-1-5-18	9/15/2021 2:48:49 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9838DD50-D1E2-4127-BE7B-B034A0C7164D}; ClientMachine = HV-CINDER-80696; User = ; ClientProcessId = 552; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{4B7C3B0F-E993-4E06-A241-3FBE06943684}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	575	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	552	2920	hv-cinder-80696	S-1-5-18	9/15/2021 2:48:49 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9838DD50-D1E2-4127-BE7B-B034A0C7164D}; ClientMachine = HV-CINDER-80696; User = ; ClientProcessId = 552; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{42B5FAAE-6536-11d2-AE5A-0000F87571E3}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	574	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	552	2920	hv-cinder-80696	S-1-5-18	9/15/2021 2:48:49 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9838DD50-D1E2-4127-BE7B-B034A0C7164D}; ClientMachine = HV-CINDER-80696; User = ; ClientProcessId = 552; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{426031c0-0b47-4852-b0ca-ac3d37bfcb39}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	573	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	552	2920	hv-cinder-80696	S-1-5-18	9/15/2021 2:48:49 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9838DD50-D1E2-4127-BE7B-B034A0C7164D}; ClientMachine = HV-CINDER-80696; User = ; ClientProcessId = 552; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{3A0DBA37-F8B2-4356-83DE-3E90BD5C261F}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	572	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	552	2920	hv-cinder-80696	S-1-5-18	9/15/2021 2:48:49 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9838DD50-D1E2-4127-BE7B-B034A0C7164D}; ClientMachine = HV-CINDER-80696; User = ; ClientProcessId = 552; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{3610eda5-77ef-11d2-8dc5-00c04fa31a66}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	571	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	552	2920	hv-cinder-80696	S-1-5-18	9/15/2021 2:48:49 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9838DD50-D1E2-4127-BE7B-B034A0C7164D}; ClientMachine = HV-CINDER-80696; User = ; ClientProcessId = 552; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{2BFCC077-22D2-48DE-BDE1-2F618D9B476D}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	570	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	552	2920	hv-cinder-80696	S-1-5-18	9/15/2021 2:48:49 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9838DD50-D1E2-4127-BE7B-B034A0C7164D}; ClientMachine = HV-CINDER-80696; User = ; ClientProcessId = 552; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{2A8FDC61-2347-4C87-92F6-B05EB91A201A}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	569	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	552	2920	hv-cinder-80696	S-1-5-18	9/15/2021 2:48:49 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9838DD50-D1E2-4127-BE7B-B034A0C7164D}; ClientMachine = HV-CINDER-80696; User = ; ClientProcessId = 552; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{1A6364EB-776B-4120-ADE1-B63A406A76B5}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	568	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	552	2920	hv-cinder-80696	S-1-5-18	9/15/2021 2:48:49 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9838DD50-D1E2-4127-BE7B-B034A0C7164D}; ClientMachine = HV-CINDER-80696; User = ; ClientProcessId = 552; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{17D89FEC-5C44-4972-B12D-241CAEF74509}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	567	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	552	2920	hv-cinder-80696	S-1-5-18	9/15/2021 2:48:49 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9838DD50-D1E2-4127-BE7B-B034A0C7164D}; ClientMachine = HV-CINDER-80696; User = ; ClientProcessId = 552; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{16be69fa-4209-4250-88cb-716cf41954e0}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	566	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	552	2920	hv-cinder-80696	S-1-5-18	9/15/2021 2:48:49 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9838DD50-D1E2-4127-BE7B-B034A0C7164D}; ClientMachine = HV-CINDER-80696; User = ; ClientProcessId = 552; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{169EBF44-942F-4C43-87CE-13C93996EBBE}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	565	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	552	2920	hv-cinder-80696	S-1-5-18	9/15/2021 2:48:49 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9838DD50-D1E2-4127-BE7B-B034A0C7164D}; ClientMachine = HV-CINDER-80696; User = ; ClientProcessId = 552; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{0E28E245-9368-4853-AD84-6DA3BA35BB75}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	564	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	552	2920	hv-cinder-80696	S-1-5-18	9/15/2021 2:48:49 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9838DD50-D1E2-4127-BE7B-B034A0C7164D}; ClientMachine = HV-CINDER-80696; User = ; ClientProcessId = 552; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{0ACDD40C-75AC-47ab-BAA0-BF6DE7E7FE63}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	563	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	552	2920	hv-cinder-80696	S-1-5-18	9/15/2021 2:48:49 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Namespace = //./root/CIMV2; NotificationQuery = select * from MSFT_SCMEventLogEvent; OwnerName = S-1-5-32-544; HostProcessID = 552; Provider= SCM Event Provider, queryID = 0; PossibleCause = Permanent	5859	0	4611686018427387904	562	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	552	4024	hv-cinder-80696	S-1-5-18	9/15/2021 2:48:47 AM	22730b0c-a9dc-0000-460b-7322dca9d701	microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Namespace = root\virtualization\v2; NotificationQuery = SELECT * FROM __ClassOperationEvent; UserName = .\SYSTEM; ClientProcessID = 0, ClientMachine = ; PossibleCause = Temporary	5860	0	4611686018427387904	561	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	552	2920	hv-cinder-80696	S-1-5-18	9/15/2021 2:48:47 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Namespace = //./root/subscription; Eventfilter = SCM Event Log Filter (refer to its activate eventid:5859); Consumer = NTEventLogEventConsumer="SCM Event Log Consumer"; PossibleCause = Binding EventFilter: instance of __EventFilter { CreatorSID = {1, 2, 0, 0, 0, 0, 0, 5, 32, 0, 0, 0, 32, 2, 0, 0}; EventNamespace = "root\\cimv2"; Name = "SCM Event Log Filter"; Query = "select * from MSFT_SCMEventLogEvent"; QueryLanguage = "WQL"; }; Perm. Consumer: instance of NTEventLogEventConsumer { Category = 0; CreatorSID = {1, 2, 0, 0, 0, 0, 0, 5, 32, 0, 0, 0, 32, 2, 0, 0}; EventType = 1; Name = "SCM Event Log Consumer"; NameOfUserSIDProperty = "sid"; SourceName = "Service Control Manager"; };	5861	0	4611686018427387904	560	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	552	4024	hv-cinder-80696	S-1-5-18	9/15/2021 2:48:47 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32a provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2964; ProviderPath = %systemroot%\system32\wbem\wmipcima.dll	5857	0	4611686018427387904	559	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2964	2992	hv-cinder-80696	S-1-5-20	9/15/2021 2:48:46 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2964; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll	5857	0	4611686018427387904	558	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2964	2992	hv-cinder-80696	S-1-5-20	9/15/2021 2:48:41 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = HV-CINDER-80696; User = NT AUTHORITY\SYSTEM; ClientProcessId = 2556; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\virtualization\v2 : Msvm_ResourcePoolComponent.Name="Microsoft\|RDV Integration Component Resource Pool\|V2.0"; ResultCode = 0x80041010; PossibleCause = Unknown	5858	2	4611686018427387904	557	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	552	2936	hv-cinder-80696	S-1-5-18	9/15/2021 2:48:40 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = HV-CINDER-80696; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1476; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User : __Namespace.name="S_1_5_21_2957006449_1083733423_2258209413_500"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	556	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	552	2924	hv-cinder-80696	S-1-5-18	9/15/2021 2:48:40 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-90DEA3SSPO1; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3056; Component = Unknown; Operation = Start IWbemServices::CreateInstanceEnum - root\wmi : MSiSCSI_PortalInfoClass; ResultCode = 0x8004100A; PossibleCause = Unknown	5858	2	4611686018427387904	555	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	544	1592	WIN-5T344G8GM1H	S-1-5-18	9/15/2021 2:48:06 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-90DEA3SSPO1; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3056; Component = Unknown; Operation = Start IWbemServices::CreateInstanceEnum - root\wmi : MS_SM_AdapterInformationQuery; ResultCode = 0x8004100A; PossibleCause = Unknown	5858	2	4611686018427387904	554	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	544	1592	WIN-5T344G8GM1H	S-1-5-18	9/15/2021 2:48:06 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-90DEA3SSPO1; User = NT AUTHORITY\SYSTEM; ClientProcessId = 2136; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\virtualization\v2 : Msvm_ResourcePoolComponent.Name="Microsoft\|RDV Integration Component Resource Pool\|V2.0"; ResultCode = 0x80041010; PossibleCause = Unknown	5858	2	4611686018427387904	553	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	544	2540	WIN-5T344G8GM1H	S-1-5-18	9/15/2021 2:47:10 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-90DEA3SSPO1; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1760; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\cimv2 : select * from Win32_OperatingSystem; ResultCode = 0x8004100A; PossibleCause = Unknown	5858	2	4611686018427387904	552	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	544	2536	WIN-5T344G8GM1H	S-1-5-18	9/15/2021 2:47:10 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4848; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\wmi : select * from WDMClassesOfDriver where ClassName = "RNDISMPStatisticsOID"; ResultCode = 0x80041032; PossibleCause = Unknown	5858	2	4611686018427387904	551	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	976	3432	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:48:09 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4848; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\wmi : select * from WMIBinaryMofResource where Name = "C:\\windows\\System32\\drivers\\en-US\\netvsc.sys.mui[NdisMofResource]"; ResultCode = 0x80041032; PossibleCause = Unknown	5858	2	4611686018427387904	550	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	976	3432	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:48:09 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
MSVDS__PROVIDER provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4460; ProviderPath = %systemroot%\system32\wbem\vdswmi.dll	5857	0	4611686018427387904	549	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	4460	5048	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 9:46:31 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4460; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll	5857	0	4611686018427387904	548	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	4460	5048	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 9:46:31 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WMIProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4848; ProviderPath = %systemroot%\system32\wbem\wmiprov.dll	5857	0	4611686018427387904	547	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	4848	4776	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:45:30 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = WIN-5T344G8GM1H\Administrator; ClientProcessId = 4956; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\Microsoft\Windows\Defender : SELECT * FROM MSFT_MpComputerStatus; ResultCode = 0x80041032; PossibleCause = Unknown	5858	2	4611686018427387904	546	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	976	1176	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:42:52 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
ProtectionManagement provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3752; ProviderPath = "%ProgramData%\Microsoft\Windows Defender\Platform\4.12.17007.18011-0\ProtectionManagement.dll"	5857	0	4611686018427387904	545	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	3752	2228	WIN-5T344G8GM1H	S-1-5-19	1/19/2018 9:42:52 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
MsNetImPlatform provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2776; ProviderPath = %systemroot%\system32\wbem\ndisimplatcim.dll	5857	0	4611686018427387904	544	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2776	3064	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 9:42:52 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4120; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll	5857	0	4611686018427387904	543	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	4120	4148	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:42:50 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
nettcpip provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2776; ProviderPath = %systemroot%\system32\wbem\NetTCPIP.dll	5857	0	4611686018427387904	542	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2776	1292	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 9:42:48 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NetAdapterCim provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3752; ProviderPath = %systemroot%\system32\wbem\NetAdapterCim.dll	5857	0	4611686018427387904	541	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	3752	2228	WIN-5T344G8GM1H	S-1-5-19	1/19/2018 9:42:48 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2776; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll	5857	0	4611686018427387904	540	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2776	3064	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 9:42:48 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
MSVDS__PROVIDER provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2776; ProviderPath = %systemroot%\system32\wbem\vdswmi.dll	5857	0	4611686018427387904	539	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2776	3064	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 9:42:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32a provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2776; ProviderPath = %systemroot%\system32\wbem\wmipcima.dll	5857	0	4611686018427387904	538	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2776	3064	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 9:42:16 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4120; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll	5857	0	4611686018427387904	537	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	4120	4148	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:41:43 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
nettcpip provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2776; ProviderPath = %systemroot%\system32\wbem\NetTCPIP.dll	5857	0	4611686018427387904	536	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2776	1292	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 9:41:39 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NetAdapterCim provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3752; ProviderPath = %systemroot%\system32\wbem\NetAdapterCim.dll	5857	0	4611686018427387904	535	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	3752	2228	WIN-5T344G8GM1H	S-1-5-19	1/19/2018 9:41:39 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2776; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll	5857	0	4611686018427387904	534	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2776	2812	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 9:41:39 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Namespace = //./root/CIMV2; NotificationQuery = select * from MSFT_SCMEventLogEvent; OwnerName = S-1-5-32-544; HostProcessID = 976; Provider= SCM Event Provider, queryID = 0; PossibleCause = Permanent	5859	0	4611686018427387904	533	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	976	2172	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:41:32 AM	ad8d0f9c-9109-0001-0a10-8dad0991d301	microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Namespace = root\virtualization\v2; NotificationQuery = SELECT * FROM __ClassOperationEvent; UserName = .\SYSTEM; ClientProcessID = 0, ClientMachine = ; PossibleCause = Temporary	5860	0	4611686018427387904	532	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	976	2680	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:41:32 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Namespace = //./root/subscription; Eventfilter = SCM Event Log Filter (refer to its activate eventid:5859); Consumer = NTEventLogEventConsumer="SCM Event Log Consumer"; PossibleCause = Binding EventFilter: instance of __EventFilter { CreatorSID = {1, 2, 0, 0, 0, 0, 0, 5, 32, 0, 0, 0, 32, 2, 0, 0}; EventNamespace = "root\\cimv2"; Name = "SCM Event Log Filter"; Query = "select * from MSFT_SCMEventLogEvent"; QueryLanguage = "WQL"; }; Perm. Consumer: instance of NTEventLogEventConsumer { Category = 0; CreatorSID = {1, 2, 0, 0, 0, 0, 0, 5, 32, 0, 0, 0, 32, 2, 0, 0}; EventType = 1; Name = "SCM Event Log Consumer"; NameOfUserSIDProperty = "sid"; SourceName = "Service Control Manager"; };	5861	0	4611686018427387904	531	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	976	388	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:41:32 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{FC491EF1-C4AA-4CE1-B329-414B101DB823}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	530	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	976	2680	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:41:32 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{fbf687e6-f063-4d9f-9f4f-fd9a26acdd5f}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	529	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	976	2680	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:41:32 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{FB2CA36D-0B40-4307-821B-A13B252DE56C}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	528	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	976	2680	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:41:32 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{f3ccc681-b74c-4060-9f26-cd84525dca2a}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	527	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	976	2680	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:41:32 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{F312195E-3D9D-447A-A3F5-08DFFA24735E}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	526	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	976	2680	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:41:32 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{E62688F0-25FD-4c90-BFF5-F508B9D2E31F}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	525	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	976	2680	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:41:32 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{E5094040-C46C-4115-B030-04FB2E545B00}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	524	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	976	2680	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:41:32 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{E4F48E54-F38D-4884-BFB9-D4D2E5729C18}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	523	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	976	2680	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:41:32 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{e437bc1c-aa7d-11d2-a382-00c04f991e27}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	522	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	976	2680	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:41:32 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{CF7639F3-ABA2-41DB-97F2-81E2C5DBFC5D}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	521	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	976	2680	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:41:32 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{cdeafc3d-948d-49dd-ab12-e578ba4af7aa}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	520	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	976	2680	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:41:32 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{c6dc5466-785a-11d2-84d0-00c04fb169f7}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	519	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	976	2680	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:41:32 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{C631DF4C-088F-4156-B058-4375F0853CD8}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	518	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	976	2680	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:41:32 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{C418DD9D-0D14-4efb-8FBF-CFE535C8FAC7}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	517	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	976	2680	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:41:32 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{C34B2751-1CF4-44F5-9262-C3FC39666591}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	516	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	976	2680	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:41:32 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{BC75B1ED-5833-4858-9BB8-CBF0B166DF9D}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	515	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	976	2680	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:41:32 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{BA649533-0AAC-4E04-B9BC-4DBAE0325B12}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	514	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	976	2680	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:41:32 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{B587E2B1-4D59-4e7e-AED9-22B9DF11D053}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	513	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	976	2680	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:41:32 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{B087BE9D-ED37-454f-AF9C-04291E351182}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	512	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	976	2680	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:41:32 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{AADCED64-746C-4633-A97C-D61349046527}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	511	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	976	2680	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:41:32 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{A3F3E39B-5D83-4940-B954-28315B82F0A8}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	510	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	976	2680	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:41:32 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{91FBB303-0CD5-4055-BF42-E512A681B325}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	509	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	976	2680	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:41:32 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{8A28E2C5-8D06-49A4-A08C-632DAA493E17}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	508	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	976	2680	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:41:32 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{827D319E-6EAC-11D2-A4EA-00C04F79F83A}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	507	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	976	2680	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:41:32 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{7B849a69-220F-451E-B3FE-2CB811AF94AE}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	506	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	976	2680	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:41:32 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{7933F41E-56F8-41d6-A31C-4148A711EE93}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	505	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	976	2680	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:41:32 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{74EE6C03-5363-4554-B161-627540339CAB}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	504	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	976	2680	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:41:32 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{728EE579-943C-4519-9EF7-AB56765798ED}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	503	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	976	2680	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:41:32 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{7150F9BF-48AD-4da4-A49C-29EF4A8369BA}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	502	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	976	2680	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:41:32 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{6A4C88C6-C502-4f74-8F60-2CB23EDC24E2}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	501	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	976	2680	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:41:32 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{6232C319-91AC-4931-9385-E70C2B099F0E}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	500	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	976	2680	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:41:32 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{4CFB60C1-FAA6-47f1-89AA-0B18730C9FD3}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	499	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	976	2680	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:41:32 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{4bcd6cde-777b-48b6-9804-43568e23545d}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	498	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	976	2680	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:41:32 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{4B7C3B0F-E993-4E06-A241-3FBE06943684}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	497	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	976	2680	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:41:32 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{42B5FAAE-6536-11d2-AE5A-0000F87571E3}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	496	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	976	2680	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:41:32 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{426031c0-0b47-4852-b0ca-ac3d37bfcb39}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	495	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	976	2680	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:41:32 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{3A0DBA37-F8B2-4356-83DE-3E90BD5C261F}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	494	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	976	2680	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:41:32 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{3610eda5-77ef-11d2-8dc5-00c04fa31a66}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	493	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	976	2680	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:41:32 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{2BFCC077-22D2-48DE-BDE1-2F618D9B476D}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	492	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	976	2680	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:41:32 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{2A8FDC61-2347-4C87-92F6-B05EB91A201A}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	491	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	976	2680	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:41:32 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{1A6364EB-776B-4120-ADE1-B63A406A76B5}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	490	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	976	2680	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:41:32 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{17D89FEC-5C44-4972-B12D-241CAEF74509}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	489	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	976	2680	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:41:32 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{16be69fa-4209-4250-88cb-716cf41954e0}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	488	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	976	2680	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:41:32 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{169EBF44-942F-4C43-87CE-13C93996EBBE}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	487	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	976	2680	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:41:32 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{0E28E245-9368-4853-AD84-6DA3BA35BB75}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	486	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	976	2680	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:41:32 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{0ACDD40C-75AC-47ab-BAA0-BF6DE7E7FE63}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	485	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	976	2680	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:41:32 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2776; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll	5857	0	4611686018427387904	484	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2776	2848	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 9:41:31 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 2204; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\virtualization\v2 : Msvm_ResourcePoolComponent.Name="Microsoft\|RDV Integration Component Resource Pool\|V2.0"; ResultCode = 0x80041010; PossibleCause = Unknown	5858	2	4611686018427387904	483	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	976	2692	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:41:30 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3176; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll	5857	0	4611686018427387904	482	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	3176	1548	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 9:40:26 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3952; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\interop\ms_409 : MSFTSM_RegisteredSubprofile; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	481	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	4728	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:38:50 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3952; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\interop\ms_409 : MSFTSM_SubProfileRequiresProfile; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	480	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	4728	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:38:50 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3952; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\interop\ms_409 : MSFTSM_RegisteredProfile; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	479	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	4728	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:38:50 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3952; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\interop\ms_409 : MSFTSM_ReferencedProfile; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	478	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	4728	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:38:50 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3952; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\interop\ms_409 : MSFTSM_ElementSoftwareIdentity; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	477	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	4728	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:38:50 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3952; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\interop\ms_409 : MSFTSM_ElementConformsToProfileEx; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	476	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	4728	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:38:50 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3952; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\interop\ms_409 : MSFTSM_ElementConformsToProfile; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	475	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	4728	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:38:50 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3952; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\cimv2\storage\ms_409 : __Namespace.Name='iscsitarget'; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	474	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	4728	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:38:50 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WMIProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3968; ProviderPath = %systemroot%\system32\wbem\wmiprov.dll	5857	0	4611686018427387904	473	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	3968	4084	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:38:50 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
MSVDS__PROVIDER provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2712; ProviderPath = %systemroot%\system32\wbem\vdswmi.dll	5857	0	4611686018427387904	472	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2712	592	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 9:38:50 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2712; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll	5857	0	4611686018427387904	471	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2712	592	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 9:38:49 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
nettcpip provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4348; ProviderPath = %systemroot%\system32\wbem\NetTCPIP.dll	5857	0	4611686018427387904	470	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	4348	2924	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 9:35:55 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NetAdapterCim provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4444; ProviderPath = %systemroot%\system32\wbem\NetAdapterCim.dll	5857	0	4611686018427387904	469	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	4444	4516	WIN-5T344G8GM1H	S-1-5-19	1/19/2018 9:35:55 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4348; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll	5857	0	4611686018427387904	468	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	4348	4632	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 9:35:55 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
MSVDS__PROVIDER provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4348; ProviderPath = %systemroot%\system32\wbem\vdswmi.dll	5857	0	4611686018427387904	467	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	4348	4632	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 9:35:41 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4348; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll	5857	0	4611686018427387904	466	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	4348	4632	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 9:35:41 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
nettcpip provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4824; ProviderPath = %systemroot%\system32\wbem\NetTCPIP.dll	5857	0	4611686018427387904	465	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	4824	1600	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 9:34:04 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NetAdapterCim provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1548; ProviderPath = %systemroot%\system32\wbem\NetAdapterCim.dll	5857	0	4611686018427387904	464	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	1548	2160	WIN-5T344G8GM1H	S-1-5-19	1/19/2018 9:34:04 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4824; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll	5857	0	4611686018427387904	463	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	4824	1600	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 9:34:04 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4824; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll	5857	0	4611686018427387904	462	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	4824	4808	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 9:34:04 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 764; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll	5857	0	4611686018427387904	461	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	764	1020	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:33:46 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
MSVDS__PROVIDER provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4824; ProviderPath = %systemroot%\system32\wbem\vdswmi.dll	5857	0	4611686018427387904	460	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	4824	4808	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 9:32:20 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4824; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll	5857	0	4611686018427387904	459	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	4824	4808	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 9:32:20 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WMIProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3968; ProviderPath = %systemroot%\system32\wbem\wmiprov.dll	5857	0	4611686018427387904	458	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	3968	4084	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:31:16 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
MSVDS__PROVIDER provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1520; ProviderPath = %systemroot%\system32\wbem\vdswmi.dll	5857	0	4611686018427387904	457	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	1520	2704	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 9:29:44 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1520; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll	5857	0	4611686018427387904	456	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	1520	2704	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 9:29:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {4693033F-66F0-46C4-8E27-99621765768B}; ClientMachine = WIN-5T344G8GM1H; User = WIN-5T344G8GM1H\Administrator; ClientProcessId = 4124; Component = Core; Operation = Start IWbemServices::ExecMethod - root\microsoft\windows\servermanager : MSFT_ServerManagerTasks::GetServerFeature; ResultCode = 0x800706BE; PossibleCause = Could not send status to client	5858	2	4611686018427387904	455	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2716	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:32 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {4693033F-66F0-46C4-8E27-99621765768B}; ClientMachine = WIN-5T344G8GM1H; User = WIN-5T344G8GM1H\Administrator; ClientProcessId = 4124; Component = Unknown; Operation = Start IWbemServices::ExecMethod - root\microsoft\windows\servermanager : MSFT_ServerManagerTasks::GetServerFeature; ResultCode = 0x80041032; PossibleCause = Unknown	5858	2	4611686018427387904	454	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	432	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:32 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4608; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll	5857	0	4611686018427387904	453	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	4608	4636	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:30 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
nettcpip provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2872; ProviderPath = %systemroot%\system32\wbem\NetTCPIP.dll	5857	0	4611686018427387904	452	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2872	2896	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 9:27:26 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NetAdapterCim provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4344; ProviderPath = %systemroot%\system32\wbem\NetAdapterCim.dll	5857	0	4611686018427387904	451	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	4344	4368	WIN-5T344G8GM1H	S-1-5-19	1/19/2018 9:27:26 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2872; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll	5857	0	4611686018427387904	450	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2872	2900	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 9:27:25 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
MSVDS__PROVIDER provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2872; ProviderPath = %systemroot%\system32\wbem\vdswmi.dll	5857	0	4611686018427387904	449	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2872	2900	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 9:27:20 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32a provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2872; ProviderPath = %systemroot%\system32\wbem\wmipcima.dll	5857	0	4611686018427387904	448	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2872	2900	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 9:27:19 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Namespace = //./root/CIMV2; NotificationQuery = select * from MSFT_SCMEventLogEvent; OwnerName = S-1-5-32-544; HostProcessID = 956; Provider= SCM Event Provider, queryID = 0; PossibleCause = Permanent	5859	0	4611686018427387904	447	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2284	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:18 AM	aff0bd57-9107-0002-9bbd-f0af0791d301	microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Namespace = root\virtualization\v2; NotificationQuery = SELECT * FROM __ClassOperationEvent; UserName = .\SYSTEM; ClientProcessID = 0, ClientMachine = ; PossibleCause = Temporary	5860	0	4611686018427387904	446	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:18 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Namespace = //./root/subscription; Eventfilter = SCM Event Log Filter (refer to its activate eventid:5859); Consumer = NTEventLogEventConsumer="SCM Event Log Consumer"; PossibleCause = Binding EventFilter: instance of __EventFilter { CreatorSID = {1, 2, 0, 0, 0, 0, 0, 5, 32, 0, 0, 0, 32, 2, 0, 0}; EventNamespace = "root\\cimv2"; Name = "SCM Event Log Filter"; Query = "select * from MSFT_SCMEventLogEvent"; QueryLanguage = "WQL"; }; Perm. Consumer: instance of NTEventLogEventConsumer { Category = 0; CreatorSID = {1, 2, 0, 0, 0, 0, 0, 5, 32, 0, 0, 0, 32, 2, 0, 0}; EventType = 1; Name = "SCM Event Log Consumer"; NameOfUserSIDProperty = "sid"; SourceName = "Service Control Manager"; };	5861	0	4611686018427387904	445	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2284	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:18 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{FC491EF1-C4AA-4CE1-B329-414B101DB823}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	444	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{fbf687e6-f063-4d9f-9f4f-fd9a26acdd5f}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	443	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{FB2CA36D-0B40-4307-821B-A13B252DE56C}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	442	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{f3ccc681-b74c-4060-9f26-cd84525dca2a}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	441	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{F312195E-3D9D-447A-A3F5-08DFFA24735E}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	440	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{E62688F0-25FD-4c90-BFF5-F508B9D2E31F}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	439	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{E5094040-C46C-4115-B030-04FB2E545B00}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	438	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{E4F48E54-F38D-4884-BFB9-D4D2E5729C18}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	437	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{e437bc1c-aa7d-11d2-a382-00c04f991e27}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	436	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{CF7639F3-ABA2-41DB-97F2-81E2C5DBFC5D}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	435	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{cdeafc3d-948d-49dd-ab12-e578ba4af7aa}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	434	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{c6dc5466-785a-11d2-84d0-00c04fb169f7}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	433	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{C631DF4C-088F-4156-B058-4375F0853CD8}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	432	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{C418DD9D-0D14-4efb-8FBF-CFE535C8FAC7}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	431	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{C34B2751-1CF4-44F5-9262-C3FC39666591}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	430	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{BC75B1ED-5833-4858-9BB8-CBF0B166DF9D}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	429	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{BA649533-0AAC-4E04-B9BC-4DBAE0325B12}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	428	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{B587E2B1-4D59-4e7e-AED9-22B9DF11D053}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	427	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{B087BE9D-ED37-454f-AF9C-04291E351182}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	426	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{AADCED64-746C-4633-A97C-D61349046527}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	425	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{A3F3E39B-5D83-4940-B954-28315B82F0A8}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	424	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{91FBB303-0CD5-4055-BF42-E512A681B325}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	423	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{8A28E2C5-8D06-49A4-A08C-632DAA493E17}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	422	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{827D319E-6EAC-11D2-A4EA-00C04F79F83A}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	421	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{7B849a69-220F-451E-B3FE-2CB811AF94AE}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	420	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2864	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{7933F41E-56F8-41d6-A31C-4148A711EE93}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	419	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2864	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{74EE6C03-5363-4554-B161-627540339CAB}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	418	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2864	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{728EE579-943C-4519-9EF7-AB56765798ED}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	417	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2864	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{7150F9BF-48AD-4da4-A49C-29EF4A8369BA}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	416	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2864	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{6A4C88C6-C502-4f74-8F60-2CB23EDC24E2}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	415	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2864	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{6232C319-91AC-4931-9385-E70C2B099F0E}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	414	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2864	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{4CFB60C1-FAA6-47f1-89AA-0B18730C9FD3}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	413	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2868	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{4bcd6cde-777b-48b6-9804-43568e23545d}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	412	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{4B7C3B0F-E993-4E06-A241-3FBE06943684}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	411	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{42B5FAAE-6536-11d2-AE5A-0000F87571E3}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	410	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2864	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{426031c0-0b47-4852-b0ca-ac3d37bfcb39}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	409	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2864	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{3A0DBA37-F8B2-4356-83DE-3E90BD5C261F}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	408	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2864	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{3610eda5-77ef-11d2-8dc5-00c04fa31a66}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	407	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2864	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{2BFCC077-22D2-48DE-BDE1-2F618D9B476D}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	406	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2864	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{2A8FDC61-2347-4C87-92F6-B05EB91A201A}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	405	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2868	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{1A6364EB-776B-4120-ADE1-B63A406A76B5}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	404	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2864	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{17D89FEC-5C44-4972-B12D-241CAEF74509}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	403	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2864	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{16be69fa-4209-4250-88cb-716cf41954e0}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	402	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2864	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{169EBF44-942F-4C43-87CE-13C93996EBBE}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	401	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{0E28E245-9368-4853-AD84-6DA3BA35BB75}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	400	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{0ACDD40C-75AC-47ab-BAA0-BF6DE7E7FE63}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	399	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{FC491EF1-C4AA-4CE1-B329-414B101DB823}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	398	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{fbf687e6-f063-4d9f-9f4f-fd9a26acdd5f}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	397	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{FB2CA36D-0B40-4307-821B-A13B252DE56C}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	396	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{f3ccc681-b74c-4060-9f26-cd84525dca2a}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	395	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{F312195E-3D9D-447A-A3F5-08DFFA24735E}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	394	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{E62688F0-25FD-4c90-BFF5-F508B9D2E31F}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	393	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{E5094040-C46C-4115-B030-04FB2E545B00}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	392	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{E4F48E54-F38D-4884-BFB9-D4D2E5729C18}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	391	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{e437bc1c-aa7d-11d2-a382-00c04f991e27}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	390	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{CF7639F3-ABA2-41DB-97F2-81E2C5DBFC5D}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	389	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{cdeafc3d-948d-49dd-ab12-e578ba4af7aa}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	388	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{c6dc5466-785a-11d2-84d0-00c04fb169f7}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	387	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{C631DF4C-088F-4156-B058-4375F0853CD8}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	386	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{C418DD9D-0D14-4efb-8FBF-CFE535C8FAC7}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	385	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{C34B2751-1CF4-44F5-9262-C3FC39666591}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	384	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{BC75B1ED-5833-4858-9BB8-CBF0B166DF9D}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	383	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{BA649533-0AAC-4E04-B9BC-4DBAE0325B12}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	382	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{B587E2B1-4D59-4e7e-AED9-22B9DF11D053}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	381	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{B087BE9D-ED37-454f-AF9C-04291E351182}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	380	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{AADCED64-746C-4633-A97C-D61349046527}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	379	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{A3F3E39B-5D83-4940-B954-28315B82F0A8}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	378	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{91FBB303-0CD5-4055-BF42-E512A681B325}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	377	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{8A28E2C5-8D06-49A4-A08C-632DAA493E17}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	376	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{827D319E-6EAC-11D2-A4EA-00C04F79F83A}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	375	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{7B849a69-220F-451E-B3FE-2CB811AF94AE}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	374	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{7933F41E-56F8-41d6-A31C-4148A711EE93}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	373	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{74EE6C03-5363-4554-B161-627540339CAB}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	372	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{728EE579-943C-4519-9EF7-AB56765798ED}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	371	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{7150F9BF-48AD-4da4-A49C-29EF4A8369BA}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	370	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{6A4C88C6-C502-4f74-8F60-2CB23EDC24E2}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	369	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{6232C319-91AC-4931-9385-E70C2B099F0E}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	368	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{4CFB60C1-FAA6-47f1-89AA-0B18730C9FD3}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	367	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{4bcd6cde-777b-48b6-9804-43568e23545d}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	366	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{4B7C3B0F-E993-4E06-A241-3FBE06943684}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	365	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{42B5FAAE-6536-11d2-AE5A-0000F87571E3}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	364	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{426031c0-0b47-4852-b0ca-ac3d37bfcb39}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	363	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{3A0DBA37-F8B2-4356-83DE-3E90BD5C261F}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	362	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{3610eda5-77ef-11d2-8dc5-00c04fa31a66}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	361	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{2BFCC077-22D2-48DE-BDE1-2F618D9B476D}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	360	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{2A8FDC61-2347-4C87-92F6-B05EB91A201A}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	359	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{1A6364EB-776B-4120-ADE1-B63A406A76B5}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	358	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{17D89FEC-5C44-4972-B12D-241CAEF74509}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	357	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{16be69fa-4209-4250-88cb-716cf41954e0}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	356	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{169EBF44-942F-4C43-87CE-13C93996EBBE}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	355	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{0E28E245-9368-4853-AD84-6DA3BA35BB75}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	354	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{0ACDD40C-75AC-47ab-BAA0-BF6DE7E7FE63}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	353	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2872; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll	5857	0	4611686018427387904	352	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2872	2900	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 2336; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\virtualization\v2 : Msvm_ResourcePoolComponent.Name="Microsoft\|RDV Integration Component Resource Pool\|V2.0"; ResultCode = 0x80041010; PossibleCause = Unknown	5858	2	4611686018427387904	351	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2864	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Namespace = ROOT\virtualization\v2; NotificationQuery = SELECT * FROM __ClassOperationEvent; UserName = .\SYSTEM; ClientProcessID = 0, ClientMachine = ; PossibleCause = Temporary	5860	0	4611686018427387904	350	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	968	2820	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:26:58 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 2360; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\virtualization\v2 : Msvm_ResourcePoolComponent.Name="Microsoft\|RDV Integration Component Resource Pool\|V2.0"; ResultCode = 0x80041010; PossibleCause = Unknown	5858	2	4611686018427387904	349	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	968	2820	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:26:52 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\HyperVCluster\v2 : Msvm_VirtualHardDiskState; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	348	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	968	2820	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:26:51 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\HyperVCluster\v2 : Msvm_VirtualHardDiskSettingData; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	347	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	968	2820	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:26:51 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\HyperVCluster\v2 : Msvm_VirtualHardDiskInfo; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	346	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	968	2820	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:26:51 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\HyperVCluster\v2 : Msvm_ServicingSettings; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	345	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	968	2820	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:26:51 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\HyperVCluster\v2 : CIM_SettingsDefineState; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	344	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	968	2820	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:26:51 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\HyperVCluster\v2 : CIM_ServiceAffectsElement; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	343	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	968	2820	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:26:51 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\HyperVCluster\v2 : CIM_ManagedElement; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	342	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	968	2820	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:26:51 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\HyperVCluster\v2 : CIM_ElementSettingData; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	341	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	968	2820	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:26:51 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\HyperVCluster\v2 : CIM_ElementCapabilities; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	340	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	968	2820	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:26:51 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\HyperVCluster\v2 : CIM_Dependency; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	339	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	968	2820	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:26:51 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\HyperVCluster\v2 : CIM_Component; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	338	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	968	2820	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:26:51 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\HyperVCluster\v2 : CIM_AffectedJobElement; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	337	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	968	2820	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:26:51 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\HyperVCluster\v2\ms_409 : Msvm_SummaryInformationBase; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	336	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	968	2820	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:26:51 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\HyperVCluster\v2\ms_409 : CIM_SettingsDefineState; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	335	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	968	2820	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:26:51 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\HyperVCluster\v2\ms_409 : CIM_ServiceAffectsElement; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	334	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	968	2824	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:26:51 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\HyperVCluster\v2\ms_409 : CIM_ManagedElement; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	333	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	968	2820	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:26:51 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\HyperVCluster\v2\ms_409 : CIM_ElementSettingData; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	332	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	968	2820	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:26:51 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\HyperVCluster\v2\ms_409 : CIM_ElementCapabilities; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	331	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	968	2820	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:26:51 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\HyperVCluster\v2\ms_409 : CIM_Dependency; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	330	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	968	2820	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:26:51 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\HyperVCluster\v2\ms_409 : CIM_Component; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	329	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	968	2820	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:26:51 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\HyperVCluster\v2\ms_409 : CIM_AffectedJobElement; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	328	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	968	2820	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:26:51 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Namespace = //./root/CIMV2; NotificationQuery = select * from MSFT_SCMEventLogEvent; OwnerName = S-1-5-32-544; HostProcessID = 968; Provider= SCM Event Provider, queryID = 0; PossibleCause = Permanent	5859	0	4611686018427387904	327	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	968	2948	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:26:51 AM	96ed06e7-9107-0000-3d07-ed960791d301	microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Namespace = //./root/subscription; Eventfilter = SCM Event Log Filter (refer to its activate eventid:5859); Consumer = NTEventLogEventConsumer="SCM Event Log Consumer"; PossibleCause = Binding EventFilter: instance of __EventFilter { CreatorSID = {1, 2, 0, 0, 0, 0, 0, 5, 32, 0, 0, 0, 32, 2, 0, 0}; EventNamespace = "root\\cimv2"; Name = "SCM Event Log Filter"; Query = "select * from MSFT_SCMEventLogEvent"; QueryLanguage = "WQL"; }; Perm. Consumer: instance of NTEventLogEventConsumer { Category = 0; CreatorSID = {1, 2, 0, 0, 0, 0, 0, 5, 32, 0, 0, 0, 32, 2, 0, 0}; EventType = 1; Name = "SCM Event Log Consumer"; NameOfUserSIDProperty = "sid"; SourceName = "Service Control Manager"; };	5861	0	4611686018427387904	326	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	968	2948	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:26:51 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2 : Msvm_VirtualDiskChangedRange; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	325	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	968	2820	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:26:50 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2 : Msvm_VHDSSnapshotInformation; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	324	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	968	2820	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:26:50 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2 : Msvm_VHDSetInformation; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	323	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	968	2820	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:26:50 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2 : Msvm_VirtualHardDiskSettingData; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	322	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	968	2820	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:26:50 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2 : Msvm_VirtualHardDiskInfo; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	321	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	968	2820	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:26:50 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2 : Msvm_SummaryInformationBase; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	320	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	968	2820	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:26:50 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2 : Msvm_ServicingSettings; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	319	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	968	2820	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:26:50 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2 : CIM_SettingsDefineState; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	318	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	968	2820	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:26:50 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2 : CIM_ServiceAffectsElement; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	317	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	968	2820	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:26:50 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2 : CIM_ManagedElement; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	316	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	968	2820	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:26:50 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2 : CIM_ElementSettingData; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	315	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	968	2820	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:26:50 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2 : CIM_ElementCapabilities; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	314	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	968	2820	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:26:50 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2 : CIM_Dependency; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	313	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	968	2820	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:26:50 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2 : CIM_Component; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	312	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	968	2820	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:26:50 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2 : CIM_AffectedJobElement; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	311	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	968	2820	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:26:50 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2\ms_409 : Msvm_VirtualDiskChangedRange; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	310	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	968	2820	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:26:49 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2\ms_409 : Msvm_VHDSSnapshotInformation; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	309	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	968	2820	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:26:49 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2\ms_409 : Msvm_VHDSetInformation; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	308	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	968	2820	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:26:49 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2\ms_409 : Msvm_VirtualHardDiskSettingData; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	307	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	968	2820	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:26:49 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2\ms_409 : Msvm_VirtualHardDiskInfo; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	306	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	968	2820	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:26:49 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2\ms_409 : Msvm_SummaryInformationBase; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	305	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	968	2820	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:26:49 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2\ms_409 : Msvm_ServicingSettings; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	304	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	968	2820	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:26:49 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2\ms_409 : CIM_SettingsDefineState; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	303	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	968	2820	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:26:49 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2\ms_409 : CIM_ServiceAffectsElement; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	302	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	968	2820	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:26:49 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2\ms_409 : CIM_ManagedElement; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	301	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	968	2820	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:26:49 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2\ms_409 : CIM_ElementSettingData; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	300	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	968	2820	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:26:49 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2\ms_409 : CIM_ElementCapabilities; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	299	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	968	2820	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:26:49 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2\ms_409 : CIM_Dependency; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	298	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	968	2820	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:26:49 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2\ms_409 : CIM_Component; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	297	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	968	2820	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:26:49 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2\ms_409 : CIM_AffectedJobElement; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	296	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	968	2820	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:26:49 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
MSVDS__PROVIDER provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2840; ProviderPath = %systemroot%\system32\wbem\vdswmi.dll	5857	0	4611686018427387904	295	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2840	2880	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 9:26:46 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32a provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2840; ProviderPath = %systemroot%\system32\wbem\wmipcima.dll	5857	0	4611686018427387904	294	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2840	2880	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 9:26:44 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2840; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll	5857	0	4611686018427387904	293	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2840	2864	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 9:26:42 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 308; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_ComputerSystem; ResultCode = 0x80041032; PossibleCause = Unknown	5858	2	4611686018427387904	292	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2620	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:25:03 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 308; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_ComputerSystem; ResultCode = 0x80041032; PossibleCause = Unknown	5858	2	4611686018427387904	291	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	404	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:25:02 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2528; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll	5857	0	4611686018427387904	290	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2528	3456	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:24:56 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
nettcpip provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2508; ProviderPath = %systemroot%\system32\wbem\NetTCPIP.dll	5857	0	4611686018427387904	289	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2508	4092	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 9:24:53 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NetAdapterCim provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2736; ProviderPath = %systemroot%\system32\wbem\NetAdapterCim.dll	5857	0	4611686018427387904	288	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2736	3804	WIN-5T344G8GM1H	S-1-5-19	1/19/2018 9:24:53 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2508; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll	5857	0	4611686018427387904	287	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2508	4092	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 9:24:53 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2508; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll	5857	0	4611686018427387904	286	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2508	2824	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 9:24:53 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3200; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll	5857	0	4611686018427387904	285	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	3200	3644	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:23:15 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
nettcpip provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2856; ProviderPath = %systemroot%\system32\wbem\NetTCPIP.dll	5857	0	4611686018427387904	284	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2856	2920	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 9:23:12 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NetAdapterCim provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2540; ProviderPath = %systemroot%\system32\wbem\NetAdapterCim.dll	5857	0	4611686018427387904	283	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2540	3240	WIN-5T344G8GM1H	S-1-5-19	1/19/2018 9:23:12 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2856; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll	5857	0	4611686018427387904	282	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2856	2884	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 9:23:11 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
MSVDS__PROVIDER provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2856; ProviderPath = %systemroot%\system32\wbem\vdswmi.dll	5857	0	4611686018427387904	281	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2856	2884	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 9:23:05 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32a provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2856; ProviderPath = %systemroot%\system32\wbem\wmipcima.dll	5857	0	4611686018427387904	280	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2856	2884	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 9:23:04 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Namespace = //./root/CIMV2; NotificationQuery = select * from MSFT_SCMEventLogEvent; OwnerName = S-1-5-32-544; HostProcessID = 956; Provider= SCM Event Provider, queryID = 0; PossibleCause = Permanent	5859	0	4611686018427387904	279	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2916	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:23:03 AM	17f2f0cc-9107-0002-12f1-f2170791d301	microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Namespace = //./root/subscription; Eventfilter = SCM Event Log Filter (refer to its activate eventid:5859); Consumer = NTEventLogEventConsumer="SCM Event Log Consumer"; PossibleCause = Binding EventFilter: instance of __EventFilter { CreatorSID = {1, 2, 0, 0, 0, 0, 0, 5, 32, 0, 0, 0, 32, 2, 0, 0}; EventNamespace = "root\\cimv2"; Name = "SCM Event Log Filter"; Query = "select * from MSFT_SCMEventLogEvent"; QueryLanguage = "WQL"; }; Perm. Consumer: instance of NTEventLogEventConsumer { Category = 0; CreatorSID = {1, 2, 0, 0, 0, 0, 0, 5, 32, 0, 0, 0, 32, 2, 0, 0}; EventType = 1; Name = "SCM Event Log Consumer"; NameOfUserSIDProperty = "sid"; SourceName = "Service Control Manager"; };	5861	0	4611686018427387904	278	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2908	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:23:03 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2856; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll	5857	0	4611686018427387904	277	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2856	2884	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 9:23:02 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3808; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll	5857	0	4611686018427387904	276	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	3808	4032	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:14:59 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
nettcpip provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2664; ProviderPath = %systemroot%\system32\wbem\NetTCPIP.dll	5857	0	4611686018427387904	275	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2664	2720	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 9:14:58 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NetAdapterCim provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2972; ProviderPath = %systemroot%\system32\wbem\NetAdapterCim.dll	5857	0	4611686018427387904	274	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2972	156	WIN-5T344G8GM1H	S-1-5-19	1/19/2018 9:14:58 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2664; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll	5857	0	4611686018427387904	273	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2664	2720	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 9:14:57 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2664; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll	5857	0	4611686018427387904	272	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2664	1584	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 9:14:57 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = WIN-5T344G8GM1H\Administrator; ClientProcessId = 1860; Component = Unknown; Operation = Start IWbemServices::PutInstance - root\cimv2 : Win32_ComputerSystem.Name="WIN-5T344G8GM1H"; ResultCode = 0x80041001; PossibleCause = Unknown	5858	2	4611686018427387904	271	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	1180	4136	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:11:39 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4368; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll	5857	0	4611686018427387904	270	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	4368	4496	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 9:10:55 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1784; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll	5857	0	4611686018427387904	269	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	1784	2240	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:05:00 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
nettcpip provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 952; ProviderPath = %systemroot%\system32\wbem\NetTCPIP.dll	5857	0	4611686018427387904	268	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	952	452	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 9:04:58 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NetAdapterCim provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1152; ProviderPath = %systemroot%\system32\wbem\NetAdapterCim.dll	5857	0	4611686018427387904	267	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	1152	1396	WIN-5T344G8GM1H	S-1-5-19	1/19/2018 9:04:58 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 952; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll	5857	0	4611686018427387904	266	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	952	452	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 9:04:57 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 952; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll	5857	0	4611686018427387904	265	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	952	1000	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 9:04:57 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WMIProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3176; ProviderPath = %systemroot%\system32\wbem\wmiprov.dll	5857	0	4611686018427387904	264	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	3176	3364	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:58:49 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
MSVDS__PROVIDER provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4672; ProviderPath = %systemroot%\system32\wbem\vdswmi.dll	5857	0	4611686018427387904	263	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	4672	4700	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 8:57:50 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4672; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll	5857	0	4611686018427387904	262	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	4672	4700	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 8:57:50 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 88; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_ComputerSystemProduct; ResultCode = 0x80041032; PossibleCause = Unknown	5858	2	4611686018427387904	261	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	1180	1284	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:56:50 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4672; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll	5857	0	4611686018427387904	260	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	4672	4700	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 8:56:50 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Namespace = //./root/CIMV2; NotificationQuery = select * from MSFT_SCMEventLogEvent; OwnerName = S-1-5-32-544; HostProcessID = 1180; Provider= SCM Event Provider, queryID = 0; PossibleCause = Permanent	5859	0	4611686018427387904	259	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	1180	4340	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:56:46 AM	289cfce6-9103-0003-f9fd-9c280391d301	microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Namespace = //./root/subscription; Eventfilter = SCM Event Log Filter (refer to its activate eventid:5859); Consumer = NTEventLogEventConsumer="SCM Event Log Consumer"; PossibleCause = Binding EventFilter: instance of __EventFilter { CreatorSID = {1, 2, 0, 0, 0, 0, 0, 5, 32, 0, 0, 0, 32, 2, 0, 0}; EventNamespace = "root\\cimv2"; Name = "SCM Event Log Filter"; Query = "select * from MSFT_SCMEventLogEvent"; QueryLanguage = "WQL"; }; Perm. Consumer: instance of NTEventLogEventConsumer { Category = 0; CreatorSID = {1, 2, 0, 0, 0, 0, 0, 5, 32, 0, 0, 0, 32, 2, 0, 0}; EventType = 1; Name = "SCM Event Log Consumer"; NameOfUserSIDProperty = "sid"; SourceName = "Service Control Manager"; };	5861	0	4611686018427387904	258	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	1180	4340	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:56:46 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
MSVDS__PROVIDER provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3968; ProviderPath = %systemroot%\system32\wbem\vdswmi.dll	5857	0	4611686018427387904	257	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	3968	4008	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 8:55:06 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32a provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3968; ProviderPath = %systemroot%\system32\wbem\wmipcima.dll	5857	0	4611686018427387904	256	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	3968	4008	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 8:55:05 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3688; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll	5857	0	4611686018427387904	255	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	3688	3696	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:55:04 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
nettcpip provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3968; ProviderPath = %systemroot%\system32\wbem\NetTCPIP.dll	5857	0	4611686018427387904	254	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	3968	4020	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 8:54:58 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NetAdapterCim provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4024; ProviderPath = %systemroot%\system32\wbem\NetAdapterCim.dll	5857	0	4611686018427387904	253	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	4024	4052	WIN-5T344G8GM1H	S-1-5-19	1/19/2018 8:54:58 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3968; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll	5857	0	4611686018427387904	252	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	3968	4008	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 8:54:58 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3968; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll	5857	0	4611686018427387904	251	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	3968	3996	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 8:54:58 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3880; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll	5857	0	4611686018427387904	250	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	3880	3916	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 8:54:38 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {7C5C4FFB-9102-0000-4A51-5C7C0291D301}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 1192; Component = Unknown; Operation = Start IWbemServices::ExecNotificationQuery - ROOT\CIMV2 : SELECT * FROM Win32_ProcessStartTrace WHERE ProcessName = 'wsmprovhost.exe'; ResultCode = 0x80041032; PossibleCause = Unknown	5858	2	4611686018427387904	249	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	1192	3004	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:54:34 AM	7c5c4ffb-9102-0000-4a51-5c7c0291d301	microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WMIProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1200; ProviderPath = %systemroot%\system32\wbem\wmiprov.dll	5857	0	4611686018427387904	248	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	1200	2840	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:54:03 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Namespace = ROOT\CIMV2; NotificationQuery = SELECT * FROM Win32_ProcessStartTrace WHERE ProcessName = 'wsmprovhost.exe'; UserName = ; ClientProcessID = 1192, ClientMachine = WIN-5T344G8GM1H; PossibleCause = Temporary	5860	0	4611686018427387904	247	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	1192	2792	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:52:27 AM	7c5c4ffb-9102-0001-8851-5c7c0291d301	microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WMI Kernel Trace Event Provider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1192; ProviderPath = C:\Windows\System32\wbem\krnlprov.dll	5857	0	4611686018427387904	246	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	1192	2792	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:52:27 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Namespace = //./root/CIMV2; NotificationQuery = select * from MSFT_SCMEventLogEvent; OwnerName = S-1-5-32-544; HostProcessID = 1192; Provider= SCM Event Provider, queryID = 0; PossibleCause = Permanent	5859	0	4611686018427387904	245	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	1192	2796	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:51:57 AM	7c5c4ffb-9102-0001-5f51-5c7c0291d301	microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Namespace = //./root/subscription; Eventfilter = SCM Event Log Filter (refer to its activate eventid:5859); Consumer = NTEventLogEventConsumer="SCM Event Log Consumer"; PossibleCause = Binding EventFilter: instance of __EventFilter { CreatorSID = {1, 2, 0, 0, 0, 0, 0, 5, 32, 0, 0, 0, 32, 2, 0, 0}; EventNamespace = "root\\cimv2"; Name = "SCM Event Log Filter"; Query = "select * from MSFT_SCMEventLogEvent"; QueryLanguage = "WQL"; }; Perm. Consumer: instance of NTEventLogEventConsumer { Category = 0; CreatorSID = {1, 2, 0, 0, 0, 0, 0, 5, 32, 0, 0, 0, 32, 2, 0, 0}; EventType = 1; Name = "SCM Event Log Consumer"; NameOfUserSIDProperty = "sid"; SourceName = "Service Control Manager"; };	5861	0	4611686018427387904	244	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	1192	2796	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:51:57 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
MSVDS__PROVIDER provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3832; ProviderPath = %systemroot%\system32\wbem\vdswmi.dll	5857	0	4611686018427387904	243	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	3832	3932	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 8:51:38 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32a provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3832; ProviderPath = %systemroot%\system32\wbem\wmipcima.dll	5857	0	4611686018427387904	242	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	3832	3872	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 8:51:37 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 428; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll	5857	0	4611686018427387904	241	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	428	1316	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:51:13 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
nettcpip provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3832; ProviderPath = %systemroot%\system32\wbem\NetTCPIP.dll	5857	0	4611686018427387904	240	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	3832	3872	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 8:51:04 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NetAdapterCim provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3888; ProviderPath = %systemroot%\system32\wbem\NetAdapterCim.dll	5857	0	4611686018427387904	239	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	3888	3916	WIN-5T344G8GM1H	S-1-5-19	1/19/2018 8:51:04 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3832; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll	5857	0	4611686018427387904	238	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	3832	3872	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 8:51:04 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3832; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll	5857	0	4611686018427387904	237	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	3832	3860	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 8:51:04 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4796; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll	5857	0	4611686018427387904	236	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	4796	840	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 8:45:55 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2284; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll	5857	0	4611686018427387904	235	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2284	2676	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:44:15 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
nettcpip provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2548; ProviderPath = %systemroot%\system32\wbem\NetTCPIP.dll	5857	0	4611686018427387904	234	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2548	2728	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 8:44:08 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NetAdapterCim provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2300; ProviderPath = %systemroot%\system32\wbem\NetAdapterCim.dll	5857	0	4611686018427387904	233	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2300	4360	WIN-5T344G8GM1H	S-1-5-19	1/19/2018 8:44:08 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2548; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll	5857	0	4611686018427387904	232	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2548	2728	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 8:44:08 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2548; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll	5857	0	4611686018427387904	231	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2548	3736	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 8:44:08 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1052; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll	5857	0	4611686018427387904	230	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	1052	4868	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 8:36:56 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3184; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll	5857	0	4611686018427387904	229	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	3184	404	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:34:15 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Win32_WIN32_TERMINALSERVICE_Prov provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1164; ProviderPath = %SystemRoot%\system32\tscfgwmi.dll	5857	0	4611686018427387904	228	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	1164	4616	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 8:34:14 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4600; Component = Unknown; Operation = Start IWbemServices::ExecQuery - ROOT\WMI : SELECT * FROM BatteryStaticData; ResultCode = 0x80041010; PossibleCause = Unknown	5858	2	4611686018427387904	227	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	964	4904	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:34:14 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4600; Component = Unknown; Operation = Start IWbemServices::ExecQuery - ROOT\WMI : SELECT * FROM BatteryFullChargedCapacity; ResultCode = 0x80041010; PossibleCause = Unknown	5858	2	4611686018427387904	226	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	964	4904	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:34:13 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
PowerWmiProvider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1164; ProviderPath = %SYSTEMROOT%\system32\PowerWmiProvider.dll	5857	0	4611686018427387904	225	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	1164	1368	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 8:34:13 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
StorageWMI provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1164; ProviderPath = %SystemRoot%\System32\storagewmi.dll	5857	0	4611686018427387904	224	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	1164	1368	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 8:34:11 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
MSVDS__PROVIDER provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1164; ProviderPath = %systemroot%\system32\wbem\vdswmi.dll	5857	0	4611686018427387904	223	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	1164	1368	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 8:34:11 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
nettcpip provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1164; ProviderPath = %systemroot%\system32\wbem\NetTCPIP.dll	5857	0	4611686018427387904	222	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	1164	1368	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 8:34:08 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NetAdapterCim provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2920; ProviderPath = %systemroot%\system32\wbem\NetAdapterCim.dll	5857	0	4611686018427387904	221	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2920	4532	WIN-5T344G8GM1H	S-1-5-19	1/19/2018 8:34:08 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1164; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll	5857	0	4611686018427387904	220	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	1164	1368	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 8:34:08 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1164; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll	5857	0	4611686018427387904	219	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	1164	1532	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 8:34:08 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9A81CB05-910F-0003-8ACC-819A0F91D301}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 964; Component = Unknown; Operation = Start IWbemServices::ExecNotificationQuery - ROOT\CIMV2 : SELECT * FROM Win32_ProcessStartTrace WHERE ProcessName = 'wsmprovhost.exe'; ResultCode = 0x80041032; PossibleCause = Unknown	5858	2	4611686018427387904	218	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	964	4228	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:33:15 AM	9a81cb05-910f-0003-8acc-819a0f91d301	microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3976; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\Microsoft\Windows\DeviceGuard : SELECT RequiredSecurityProperties FROM Win32_DeviceGuard ; ResultCode = 0x80041032; PossibleCause = Unknown	5858	2	4611686018427387904	217	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	964	1824	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:33:01 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3976; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\Microsoft\Windows\DeviceGuard : SELECT SecurityServicesConfigured FROM Win32_DeviceGuard ; ResultCode = 0x80041032; PossibleCause = Unknown	5858	2	4611686018427387904	216	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	964	5076	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:33:01 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Win32_TpmProvider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1164; ProviderPath = C:\Windows\system32\wbem\Win32_TPM.dll	5857	0	4611686018427387904	215	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	1164	1532	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 8:33:01 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3976; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\Microsoft\Windows\DeviceGuard : SELECT VirtualizationBasedSecurityStatus FROM Win32_DeviceGuard ; ResultCode = 0x80041032; PossibleCause = Unknown	5858	2	4611686018427387904	214	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	964	5076	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:33:01 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3976; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\Microsoft\Windows\DeviceGuard : SELECT SecurityServicesRunning FROM Win32_DeviceGuard ; ResultCode = 0x80041032; PossibleCause = Unknown	5858	2	4611686018427387904	213	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	964	5076	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:33:01 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3976; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\Microsoft\Windows\DeviceGuard : SELECT AvailableSecurityProperties FROM Win32_DeviceGuard ; ResultCode = 0x80041032; PossibleCause = Unknown	5858	2	4611686018427387904	212	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	964	1824	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:33:01 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3976; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\Microsoft\Windows\DeviceGuard : SELECT RequiredSecurityProperties FROM Win32_DeviceGuard ; ResultCode = 0x80041032; PossibleCause = Unknown	5858	2	4611686018427387904	211	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	964	5076	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:33:01 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Win32_DeviceGuard provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1164; ProviderPath = %SystemRoot%\System32\Win32_DeviceGuard.dll	5857	0	4611686018427387904	210	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	1164	1532	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 8:33:01 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3976; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\CIMV2 : SELECT SMBIOSAssetTag FROM Win32_SystemEnclosure ; ResultCode = 0x80041032; PossibleCause = Unknown	5858	2	4611686018427387904	209	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	964	5076	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:32:59 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
MSVDS__PROVIDER provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1164; ProviderPath = %systemroot%\system32\wbem\vdswmi.dll	5857	0	4611686018427387904	208	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	1164	1532	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 8:32:59 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1164; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll	5857	0	4611686018427387904	207	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	1164	2868	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 8:32:58 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1912; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll	5857	0	4611686018427387904	206	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	1912	3084	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:32:58 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
ServerFeatureProvider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1164; ProviderPath = %windir%\system32\wbem\servercompprov.dll	5857	0	4611686018427387904	205	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	1164	1532	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 8:32:58 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
MSVDS__PROVIDER provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 996; ProviderPath = %systemroot%\system32\wbem\vdswmi.dll	5857	0	4611686018427387904	204	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	996	456	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 8:29:00 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 996; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll	5857	0	4611686018427387904	203	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	996	456	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 8:29:00 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WMIProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4324; ProviderPath = %systemroot%\system32\wbem\wmiprov.dll	5857	0	4611686018427387904	202	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	4324	3568	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:27:56 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Namespace = ROOT\CIMV2; NotificationQuery = SELECT * FROM Win32_ProcessStartTrace WHERE ProcessName = 'wsmprovhost.exe'; UserName = ; ClientProcessID = 964, ClientMachine = WIN-5T344G8GM1H; PossibleCause = Temporary	5860	0	4611686018427387904	201	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	964	3260	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:26:55 AM	9a81cb05-910f-0000-a4cc-819a0f91d301	microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WMI Kernel Trace Event Provider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 964; ProviderPath = C:\Windows\System32\wbem\krnlprov.dll	5857	0	4611686018427387904	200	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	964	3260	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:26:55 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
MSVDS__PROVIDER provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3772; ProviderPath = %systemroot%\system32\wbem\vdswmi.dll	5857	0	4611686018427387904	199	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	3772	3768	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 8:26:50 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3772; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll	5857	0	4611686018427387904	198	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	3772	3768	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 8:25:57 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Namespace = //./root/CIMV2; NotificationQuery = select * from MSFT_SCMEventLogEvent; OwnerName = S-1-5-32-544; HostProcessID = 964; Provider= SCM Event Provider, queryID = 0; PossibleCause = Permanent	5859	0	4611686018427387904	197	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	964	4648	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:25:52 AM	9a81cb05-910f-0003-4bcc-819a0f91d301	microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Namespace = //./root/subscription; Eventfilter = SCM Event Log Filter (refer to its activate eventid:5859); Consumer = NTEventLogEventConsumer="SCM Event Log Consumer"; PossibleCause = Binding EventFilter: instance of __EventFilter { CreatorSID = {1, 2, 0, 0, 0, 0, 0, 5, 32, 0, 0, 0, 32, 2, 0, 0}; EventNamespace = "root\\cimv2"; Name = "SCM Event Log Filter"; Query = "select * from MSFT_SCMEventLogEvent"; QueryLanguage = "WQL"; }; Perm. Consumer: instance of NTEventLogEventConsumer { Category = 0; CreatorSID = {1, 2, 0, 0, 0, 0, 0, 5, 32, 0, 0, 0, 32, 2, 0, 0}; EventType = 1; Name = "SCM Event Log Consumer"; NameOfUserSIDProperty = "sid"; SourceName = "Service Control Manager"; };	5861	0	4611686018427387904	196	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	964	4648	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:25:52 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
MSVDS__PROVIDER provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3772; ProviderPath = %systemroot%\system32\wbem\vdswmi.dll	5857	0	4611686018427387904	195	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	3772	3768	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 8:24:46 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4124; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll	5857	0	4611686018427387904	194	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	4124	4152	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:24:15 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
nettcpip provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3772; ProviderPath = %systemroot%\system32\wbem\NetTCPIP.dll	5857	0	4611686018427387904	193	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	3772	3820	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 8:24:08 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NetAdapterCim provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3084; ProviderPath = %systemroot%\system32\wbem\NetAdapterCim.dll	5857	0	4611686018427387904	192	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	3084	3436	WIN-5T344G8GM1H	S-1-5-19	1/19/2018 8:24:08 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3772; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll	5857	0	4611686018427387904	191	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	3772	3800	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 8:24:08 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32a provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3772; ProviderPath = %systemroot%\system32\wbem\wmipcima.dll	5857	0	4611686018427387904	190	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	3772	3800	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 8:24:03 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3772; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll	5857	0	4611686018427387904	189	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	3772	3800	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 8:24:03 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3868; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll	5857	0	4611686018427387904	188	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	3868	3176	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 6:37:16 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
nettcpip provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2504; ProviderPath = %systemroot%\system32\wbem\NetTCPIP.dll	5857	0	4611686018427387904	187	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2504	2192	WIN-5T344G8GM1H	S-1-5-20	1/16/2018 6:37:14 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NetAdapterCim provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2788; ProviderPath = %systemroot%\system32\wbem\NetAdapterCim.dll	5857	0	4611686018427387904	186	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2788	2624	WIN-5T344G8GM1H	S-1-5-19	1/16/2018 6:37:14 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2504; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll	5857	0	4611686018427387904	185	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2504	2192	WIN-5T344G8GM1H	S-1-5-20	1/16/2018 6:37:14 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2504; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll	5857	0	4611686018427387904	184	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2504	2440	WIN-5T344G8GM1H	S-1-5-20	1/16/2018 6:37:14 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4024; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll	5857	0	4611686018427387904	183	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	4024	3868	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 6:27:16 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
nettcpip provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1288; ProviderPath = %systemroot%\system32\wbem\NetTCPIP.dll	5857	0	4611686018427387904	182	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	1288	3280	WIN-5T344G8GM1H	S-1-5-20	1/16/2018 6:27:14 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NetAdapterCim provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1500; ProviderPath = %systemroot%\system32\wbem\NetAdapterCim.dll	5857	0	4611686018427387904	181	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	1500	2664	WIN-5T344G8GM1H	S-1-5-19	1/16/2018 6:27:14 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1288; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll	5857	0	4611686018427387904	180	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	1288	3280	WIN-5T344G8GM1H	S-1-5-20	1/16/2018 6:27:14 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1288; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll	5857	0	4611686018427387904	179	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	1288	4056	WIN-5T344G8GM1H	S-1-5-20	1/16/2018 6:27:14 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 652; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll	5857	0	4611686018427387904	178	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	652	1972	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 6:17:16 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
nettcpip provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4032; ProviderPath = %systemroot%\system32\wbem\NetTCPIP.dll	5857	0	4611686018427387904	177	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	4032	3152	WIN-5T344G8GM1H	S-1-5-20	1/16/2018 6:17:14 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NetAdapterCim provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3688; ProviderPath = %systemroot%\system32\wbem\NetAdapterCim.dll	5857	0	4611686018427387904	176	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	3688	3124	WIN-5T344G8GM1H	S-1-5-19	1/16/2018 6:17:14 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4032; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll	5857	0	4611686018427387904	175	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	4032	1184	WIN-5T344G8GM1H	S-1-5-20	1/16/2018 6:17:14 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4032; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll	5857	0	4611686018427387904	174	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	4032	1160	WIN-5T344G8GM1H	S-1-5-20	1/16/2018 6:17:14 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WMIProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1088; ProviderPath = %systemroot%\system32\wbem\wmiprov.dll	5857	0	4611686018427387904	173	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	1088	4088	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 6:10:25 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2784; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll	5857	0	4611686018427387904	172	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2784	1752	WIN-5T344G8GM1H	S-1-5-20	1/16/2018 6:08:29 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Namespace = //./root/CIMV2; NotificationQuery = select * from MSFT_SCMEventLogEvent; OwnerName = S-1-5-32-544; HostProcessID = 1176; Provider= SCM Event Provider, queryID = 0; PossibleCause = Permanent	5859	0	4611686018427387904	171	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	1176	3928	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 6:08:20 PM	b65c0852-8ef4-0003-8709-5cb6f48ed301	microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Namespace = //./root/subscription; Eventfilter = SCM Event Log Filter (refer to its activate eventid:5859); Consumer = NTEventLogEventConsumer="SCM Event Log Consumer"; PossibleCause = Binding EventFilter: instance of __EventFilter { CreatorSID = {1, 2, 0, 0, 0, 0, 0, 5, 32, 0, 0, 0, 32, 2, 0, 0}; EventNamespace = "root\\cimv2"; Name = "SCM Event Log Filter"; Query = "select * from MSFT_SCMEventLogEvent"; QueryLanguage = "WQL"; }; Perm. Consumer: instance of NTEventLogEventConsumer { Category = 0; CreatorSID = {1, 2, 0, 0, 0, 0, 0, 5, 32, 0, 0, 0, 32, 2, 0, 0}; EventType = 1; Name = "SCM Event Log Consumer"; NameOfUserSIDProperty = "sid"; SourceName = "Service Control Manager"; };	5861	0	4611686018427387904	170	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	1176	3928	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 6:08:20 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
MSVDS__PROVIDER provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2784; ProviderPath = %systemroot%\system32\wbem\vdswmi.dll	5857	0	4611686018427387904	169	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2784	1752	WIN-5T344G8GM1H	S-1-5-20	1/16/2018 6:07:37 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32a provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2784; ProviderPath = %systemroot%\system32\wbem\wmipcima.dll	5857	0	4611686018427387904	168	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2784	1752	WIN-5T344G8GM1H	S-1-5-20	1/16/2018 6:07:36 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
nettcpip provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2784; ProviderPath = %systemroot%\system32\wbem\NetTCPIP.dll	5857	0	4611686018427387904	167	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2784	4072	WIN-5T344G8GM1H	S-1-5-20	1/16/2018 6:07:14 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NetAdapterCim provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4076; ProviderPath = %systemroot%\system32\wbem\NetAdapterCim.dll	5857	0	4611686018427387904	166	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	4076	1920	WIN-5T344G8GM1H	S-1-5-19	1/16/2018 6:07:14 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2784; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll	5857	0	4611686018427387904	165	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2784	4060	WIN-5T344G8GM1H	S-1-5-20	1/16/2018 6:07:14 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2784; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll	5857	0	4611686018427387904	164	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2784	2824	WIN-5T344G8GM1H	S-1-5-20	1/16/2018 6:07:14 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 2584; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\Microsoft\Windows\DeviceGuard : SELECT AvailableSecurityProperties FROM Win32_DeviceGuard ; ResultCode = 0x80041032; PossibleCause = Unknown	5858	2	4611686018427387904	163	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	1176	2580	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 6:06:34 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 2584; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\Microsoft\Windows\DeviceGuard : SELECT RequiredSecurityProperties FROM Win32_DeviceGuard ; ResultCode = 0x80041032; PossibleCause = Unknown	5858	2	4611686018427387904	162	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	1176	2580	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 6:06:34 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 2584; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\Microsoft\Windows\DeviceGuard : SELECT SecurityServicesConfigured FROM Win32_DeviceGuard ; ResultCode = 0x80041032; PossibleCause = Unknown	5858	2	4611686018427387904	161	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	1176	2640	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 6:06:34 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Win32_TpmProvider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2784; ProviderPath = C:\Windows\system32\wbem\Win32_TPM.dll	5857	0	4611686018427387904	160	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2784	2824	WIN-5T344G8GM1H	S-1-5-20	1/16/2018 6:06:34 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 2584; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\Microsoft\Windows\DeviceGuard : SELECT VirtualizationBasedSecurityStatus FROM Win32_DeviceGuard ; ResultCode = 0x80041032; PossibleCause = Unknown	5858	2	4611686018427387904	159	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	1176	2640	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 6:06:33 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 2584; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\Microsoft\Windows\DeviceGuard : SELECT SecurityServicesRunning FROM Win32_DeviceGuard ; ResultCode = 0x80041032; PossibleCause = Unknown	5858	2	4611686018427387904	158	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	1176	2580	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 6:06:33 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 2584; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\Microsoft\Windows\DeviceGuard : SELECT SecurityServicesRunning FROM Win32_DeviceGuard ; ResultCode = 0x80041032; PossibleCause = Unknown	5858	2	4611686018427387904	157	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	1176	2580	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 6:06:33 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 2584; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\Microsoft\Windows\DeviceGuard : SELECT AvailableSecurityProperties FROM Win32_DeviceGuard ; ResultCode = 0x80041032; PossibleCause = Unknown	5858	2	4611686018427387904	156	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	1176	2580	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 6:06:33 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 2584; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\Microsoft\Windows\DeviceGuard : SELECT RequiredSecurityProperties FROM Win32_DeviceGuard ; ResultCode = 0x80041032; PossibleCause = Unknown	5858	2	4611686018427387904	155	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	1176	2580	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 6:06:33 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Win32_DeviceGuard provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2784; ProviderPath = %SystemRoot%\System32\Win32_DeviceGuard.dll	5857	0	4611686018427387904	154	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2784	2824	WIN-5T344G8GM1H	S-1-5-20	1/16/2018 6:06:33 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 2584; Component = Unknown; Operation = Start IWbemServices::ExecQuery - ROOT\CIMV2 : select ChassisTypes from Win32_SystemEnclosure; ResultCode = 0x80041032; PossibleCause = Unknown	5858	2	4611686018427387904	153	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	1176	2640	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 6:06:33 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2784; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll	5857	0	4611686018427387904	152	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2784	2824	WIN-5T344G8GM1H	S-1-5-20	1/16/2018 6:06:32 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 2584; Component = Unknown; Operation = Start IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT ID FROM Win32_ServerFeature; ResultCode = 0x80041032; PossibleCause = Unknown	5858	2	4611686018427387904	151	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	1176	2640	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 6:06:32 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2832; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll	5857	0	4611686018427387904	150	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2832	2860	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 6:06:27 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
ServerFeatureProvider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2784; ProviderPath = %windir%\system32\wbem\servercompprov.dll	5857	0	4611686018427387904	149	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2784	2812	WIN-5T344G8GM1H	S-1-5-20	1/16/2018 6:06:27 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4892; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll	5857	0	4611686018427387904	148	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	4892	836	WIN-5T344G8GM1H	S-1-5-20	1/16/2018 6:02:36 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4256; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll	5857	0	4611686018427387904	147	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	4256	4144	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:53:30 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
nettcpip provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4976; ProviderPath = %systemroot%\system32\wbem\NetTCPIP.dll	5857	0	4611686018427387904	146	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	4976	3800	WIN-5T344G8GM1H	S-1-5-20	1/16/2018 5:53:24 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NetAdapterCim provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 5092; ProviderPath = %systemroot%\system32\wbem\NetAdapterCim.dll	5857	0	4611686018427387904	145	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	5092	2628	WIN-5T344G8GM1H	S-1-5-19	1/16/2018 5:53:24 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4976; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll	5857	0	4611686018427387904	144	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	4976	3800	WIN-5T344G8GM1H	S-1-5-20	1/16/2018 5:53:23 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4976; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll	5857	0	4611686018427387904	143	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	4976	5116	WIN-5T344G8GM1H	S-1-5-20	1/16/2018 5:53:23 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {53B2B737-8EF1-0000-6DB9-B253F18ED301}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 1152; Component = Unknown; Operation = Start IWbemServices::ExecNotificationQuery - ROOT\CIMV2 : SELECT * FROM Win32_ProcessStartTrace WHERE ProcessName = 'wsmprovhost.exe'; ResultCode = 0x80041032; PossibleCause = Unknown	5858	2	4611686018427387904	142	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	1152	4780	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:50:11 PM	53b2b737-8ef1-0000-6db9-b253f18ed301	microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WMIProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3688; ProviderPath = %systemroot%\system32\wbem\wmiprov.dll	5857	0	4611686018427387904	141	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	3688	2160	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:46:15 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Namespace = ROOT\CIMV2; NotificationQuery = SELECT * FROM Win32_ProcessStartTrace WHERE ProcessName = 'wsmprovhost.exe'; UserName = ; ClientProcessID = 1152, ClientMachine = WIN-5T344G8GM1H; PossibleCause = Temporary	5860	0	4611686018427387904	140	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	1152	4676	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:44:23 PM	53b2b737-8ef1-0003-feb9-b253f18ed301	microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WMI Kernel Trace Event Provider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1152; ProviderPath = C:\Windows\System32\wbem\krnlprov.dll	5857	0	4611686018427387904	139	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	1152	4676	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:44:23 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 400; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_ComputerSystemProduct; ResultCode = 0x80041032; PossibleCause = Unknown	5858	2	4611686018427387904	138	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	1152	2600	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:44:12 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4212; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll	5857	0	4611686018427387904	137	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	4212	4236	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:43:31 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
MSVDS__PROVIDER provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 976; ProviderPath = %systemroot%\system32\wbem\vdswmi.dll	5857	0	4611686018427387904	136	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	976	2796	WIN-5T344G8GM1H	S-1-5-20	1/16/2018 5:43:29 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
nettcpip provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 976; ProviderPath = %systemroot%\system32\wbem\NetTCPIP.dll	5857	0	4611686018427387904	135	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	976	3216	WIN-5T344G8GM1H	S-1-5-20	1/16/2018 5:43:23 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NetAdapterCim provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3208; ProviderPath = %systemroot%\system32\wbem\NetAdapterCim.dll	5857	0	4611686018427387904	134	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	3208	3308	WIN-5T344G8GM1H	S-1-5-19	1/16/2018 5:43:23 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 976; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll	5857	0	4611686018427387904	133	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	976	324	WIN-5T344G8GM1H	S-1-5-20	1/16/2018 5:43:23 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32a provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 976; ProviderPath = %systemroot%\system32\wbem\wmipcima.dll	5857	0	4611686018427387904	132	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	976	324	WIN-5T344G8GM1H	S-1-5-20	1/16/2018 5:43:17 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 976; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll	5857	0	4611686018427387904	131	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	976	324	WIN-5T344G8GM1H	S-1-5-20	1/16/2018 5:43:17 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Namespace = //./root/CIMV2; NotificationQuery = select * from MSFT_SCMEventLogEvent; OwnerName = S-1-5-32-544; HostProcessID = 1152; Provider= SCM Event Provider, queryID = 0; PossibleCause = Permanent	5859	0	4611686018427387904	130	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	1152	2720	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:42:38 PM	53b2b737-8ef1-0001-8eb7-b253f18ed301	microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Namespace = //./root/subscription; Eventfilter = SCM Event Log Filter (refer to its activate eventid:5859); Consumer = NTEventLogEventConsumer="SCM Event Log Consumer"; PossibleCause = Binding EventFilter: instance of __EventFilter { CreatorSID = {1, 2, 0, 0, 0, 0, 0, 5, 32, 0, 0, 0, 32, 2, 0, 0}; EventNamespace = "root\\cimv2"; Name = "SCM Event Log Filter"; Query = "select * from MSFT_SCMEventLogEvent"; QueryLanguage = "WQL"; }; Perm. Consumer: instance of NTEventLogEventConsumer { Category = 0; CreatorSID = {1, 2, 0, 0, 0, 0, 0, 5, 32, 0, 0, 0, 32, 2, 0, 0}; EventType = 1; Name = "SCM Event Log Consumer"; NameOfUserSIDProperty = "sid"; SourceName = "Service Control Manager"; };	5861	0	4611686018427387904	129	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	1152	2720	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:42:38 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {A4626349-8EA8-0003-B36D-62A4A88ED301}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::ExecNotificationQuery - ROOT\CIMV2 : SELECT * FROM Win32_ProcessStartTrace WHERE ProcessName = 'wsmprovhost.exe'; ResultCode = 0x80041032; PossibleCause = Unknown	5858	2	4611686018427387904	128	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	3696	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:37:24 PM	a4626349-8ea8-0003-b36d-62a4a88ed301	microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 164; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll	5857	0	4611686018427387904	127	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	164	3628	WIN-5T344G8GM1H	S-1-5-20	1/16/2018 5:35:48 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WmiPerfInst provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3868; ProviderPath = C:\Windows\System32\wbem\WmiPerfInst.dll	5857	0	4611686018427387904	126	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	3868	1388	WIN-5T344G8GM1H	S-1-5-19	1/16/2018 5:35:07 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WMIProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4924; ProviderPath = %systemroot%\system32\wbem\wmiprov.dll	5857	0	4611686018427387904	125	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	4924	428	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:35:04 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WmiPerfClass provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4924; ProviderPath = C:\Windows\System32\wbem\WmiPerfClass.dll	5857	0	4611686018427387904	124	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	4924	5928	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:35:03 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Namespace = ROOT\CIMV2; NotificationQuery = SELECT * FROM Win32_ProcessStartTrace WHERE ProcessName = 'wsmprovhost.exe'; UserName = ; ClientProcessID = 924, ClientMachine = WIN-5T344G8GM1H; PossibleCause = Temporary	5860	0	4611686018427387904	123	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2052	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:34:06 PM	a4626349-8ea8-0002-ed6e-62a4a88ed301	microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WMI Kernel Trace Event Provider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 924; ProviderPath = C:\Windows\System32\wbem\krnlprov.dll	5857	0	4611686018427387904	122	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2052	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:34:06 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 5028; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll	5857	0	4611686018427387904	121	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	5028	5328	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:32:53 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
nettcpip provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 5804; ProviderPath = %systemroot%\system32\wbem\NetTCPIP.dll	5857	0	4611686018427387904	120	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	5804	5824	WIN-5T344G8GM1H	S-1-5-20	1/16/2018 5:32:40 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NetAdapterCim provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3816; ProviderPath = %systemroot%\system32\wbem\NetAdapterCim.dll	5857	0	4611686018427387904	119	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	3816	1224	WIN-5T344G8GM1H	S-1-5-19	1/16/2018 5:32:40 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 5804; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll	5857	0	4611686018427387904	118	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	5804	5824	WIN-5T344G8GM1H	S-1-5-20	1/16/2018 5:32:40 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 5804; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll	5857	0	4611686018427387904	117	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	5804	912	WIN-5T344G8GM1H	S-1-5-20	1/16/2018 5:32:40 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3180; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll	5857	0	4611686018427387904	116	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	3180	804	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:22:47 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
nettcpip provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3772; ProviderPath = %systemroot%\system32\wbem\NetTCPIP.dll	5857	0	4611686018427387904	115	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	3772	5300	WIN-5T344G8GM1H	S-1-5-20	1/16/2018 5:22:40 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NetAdapterCim provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 888; ProviderPath = %systemroot%\system32\wbem\NetAdapterCim.dll	5857	0	4611686018427387904	114	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	888	5288	WIN-5T344G8GM1H	S-1-5-19	1/16/2018 5:22:40 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3772; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll	5857	0	4611686018427387904	113	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	3772	5300	WIN-5T344G8GM1H	S-1-5-20	1/16/2018 5:22:40 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3772; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll	5857	0	4611686018427387904	112	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	3772	3704	WIN-5T344G8GM1H	S-1-5-20	1/16/2018 5:22:40 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 5964; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll	5857	0	4611686018427387904	111	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	5964	3468	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:12:54 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {A4626349-8EA8-0000-8A6D-62A4A88ED301}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::ExecNotificationQuery - ROOT\CIMV2 : SELECT * FROM Win32_ProcessStartTrace WHERE ProcessName = 'wsmprovhost.exe'; ResultCode = 0x80041032; PossibleCause = Unknown	5858	2	4611686018427387904	110	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	1992	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:12:41 PM	a4626349-8ea8-0000-8a6d-62a4a88ed301	microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
nettcpip provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1260; ProviderPath = %systemroot%\system32\wbem\NetTCPIP.dll	5857	0	4611686018427387904	109	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	1260	1960	WIN-5T344G8GM1H	S-1-5-20	1/16/2018 5:12:40 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NetAdapterCim provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2736; ProviderPath = %systemroot%\system32\wbem\NetAdapterCim.dll	5857	0	4611686018427387904	108	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2736	2320	WIN-5T344G8GM1H	S-1-5-19	1/16/2018 5:12:40 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1260; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll	5857	0	4611686018427387904	107	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	1260	1960	WIN-5T344G8GM1H	S-1-5-20	1/16/2018 5:12:40 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1260; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll	5857	0	4611686018427387904	106	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	1260	1936	WIN-5T344G8GM1H	S-1-5-20	1/16/2018 5:12:40 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Namespace = ROOT\CIMV2; NotificationQuery = SELECT * FROM Win32_ProcessStartTrace WHERE ProcessName = 'wsmprovhost.exe'; UserName = ; ClientProcessID = 924, ClientMachine = WIN-5T344G8GM1H; PossibleCause = Temporary	5860	0	4611686018427387904	105	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	3016	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:06:17 PM	a4626349-8ea8-0003-146c-62a4a88ed301	microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WMI Kernel Trace Event Provider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 924; ProviderPath = C:\Windows\System32\wbem\krnlprov.dll	5857	0	4611686018427387904	104	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	3016	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:06:17 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
MSVDS__PROVIDER provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3428; ProviderPath = %systemroot%\system32\wbem\vdswmi.dll	5857	0	4611686018427387904	103	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	3428	5844	WIN-5T344G8GM1H	S-1-5-20	1/16/2018 5:06:06 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3428; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll	5857	0	4611686018427387904	102	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	3428	5844	WIN-5T344G8GM1H	S-1-5-20	1/16/2018 5:06:06 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WMIProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2768; ProviderPath = %systemroot%\system32\wbem\wmiprov.dll	5857	0	4611686018427387904	101	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2768	1104	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:05:59 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2856; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll	5857	0	4611686018427387904	100	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2856	3704	WIN-5T344G8GM1H	S-1-5-20	1/16/2018 5:04:01 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Namespace = //./root/CIMV2; NotificationQuery = select * from MSFT_SCMEventLogEvent; OwnerName = S-1-5-32-544; HostProcessID = 924; Provider= SCM Event Provider, queryID = 0; PossibleCause = Permanent	5859	0	4611686018427387904	99	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	3356	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:03:48 PM	a4626349-8ea8-0003-c36b-62a4a88ed301	microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Namespace = //./root/subscription; Eventfilter = SCM Event Log Filter (refer to its activate eventid:5859); Consumer = NTEventLogEventConsumer="SCM Event Log Consumer"; PossibleCause = Binding EventFilter: instance of __EventFilter { CreatorSID = {1, 2, 0, 0, 0, 0, 0, 5, 32, 0, 0, 0, 32, 2, 0, 0}; EventNamespace = "root\\cimv2"; Name = "SCM Event Log Filter"; Query = "select * from MSFT_SCMEventLogEvent"; QueryLanguage = "WQL"; }; Perm. Consumer: instance of NTEventLogEventConsumer { Category = 0; CreatorSID = {1, 2, 0, 0, 0, 0, 0, 5, 32, 0, 0, 0, 32, 2, 0, 0}; EventType = 1; Name = "SCM Event Log Consumer"; NameOfUserSIDProperty = "sid"; SourceName = "Service Control Manager"; };	5861	0	4611686018427387904	98	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	1768	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:03:48 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
MSVDS__PROVIDER provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2856; ProviderPath = %systemroot%\system32\wbem\vdswmi.dll	5857	0	4611686018427387904	97	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2856	3704	WIN-5T344G8GM1H	S-1-5-20	1/16/2018 5:02:51 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
nettcpip provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2856; ProviderPath = %systemroot%\system32\wbem\NetTCPIP.dll	5857	0	4611686018427387904	96	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2856	812	WIN-5T344G8GM1H	S-1-5-20	1/16/2018 5:02:39 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NetAdapterCim provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 5960; ProviderPath = %systemroot%\system32\wbem\NetAdapterCim.dll	5857	0	4611686018427387904	95	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	5960	5988	WIN-5T344G8GM1H	S-1-5-19	1/16/2018 5:02:39 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2856; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll	5857	0	4611686018427387904	94	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2856	3084	WIN-5T344G8GM1H	S-1-5-20	1/16/2018 5:02:39 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 2972; Component = Unknown; Operation = Start IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT ID FROM Win32_ServerFeature; ResultCode = 0x80041032; PossibleCause = Unknown	5858	2	4611686018427387904	93	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2352	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:13 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{FB2CA36D-0B40-4307-821B-A13B252DE56C}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	92	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2512	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:11 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{F9C77450-3A41-477E-9310-9ACD617BD9E3}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	91	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2512	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:11 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{E62688F0-25FD-4c90-BFF5-F508B9D2E31F}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	90	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2512	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:11 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{E5094040-C46C-4115-B030-04FB2E545B00}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	89	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2512	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:11 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{E4F48E54-F38D-4884-BFB9-D4D2E5729C18}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	88	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2512	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:11 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{E47248BA-94CC-49c4-BBB5-9EB7F05183D0}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	87	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2512	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:11 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{CF7639F3-ABA2-41DB-97F2-81E2C5DBFC5D}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	86	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2512	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:11 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{c6dc5466-785a-11d2-84d0-00c04fb169f7}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	85	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2512	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:11 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{C631DF4C-088F-4156-B058-4375F0853CD8}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	84	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2512	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:11 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{C418DD9D-0D14-4efb-8FBF-CFE535C8FAC7}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	83	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2512	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:11 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{C34B2751-1CF4-44F5-9262-C3FC39666591}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	82	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2512	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:11 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{BC75B1ED-5833-4858-9BB8-CBF0B166DF9D}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	81	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2512	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:11 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{BA649533-0AAC-4E04-B9BC-4DBAE0325B12}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	80	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2512	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:11 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{B087BE9D-ED37-454f-AF9C-04291E351182}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	79	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2512	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:11 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{AADCED64-746C-4633-A97C-D61349046527}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	78	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2512	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:11 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{A3F3E39B-5D83-4940-B954-28315B82F0A8}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	77	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2512	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:11 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{91FBB303-0CD5-4055-BF42-E512A681B325}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	76	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2512	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:11 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{8A28E2C5-8D06-49A4-A08C-632DAA493E17}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	75	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2512	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:11 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{7B849a69-220F-451E-B3FE-2CB811AF94AE}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	74	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2512	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:11 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{7933F41E-56F8-41d6-A31C-4148A711EE93}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	73	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2512	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:11 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{74EE6C03-5363-4554-B161-627540339CAB}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	72	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2512	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:11 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{728EE579-943C-4519-9EF7-AB56765798ED}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	71	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2512	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:11 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{7150F9BF-48AD-4da4-A49C-29EF4A8369BA}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	70	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2512	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:11 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{6232C319-91AC-4931-9385-E70C2B099F0E}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	69	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2512	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:11 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{5794DAFD-BE60-433f-88A2-1A31939AC01F}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	68	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2512	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:11 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{4D2F9B6F-1E52-4711-A382-6A8B1A003DE6}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	67	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2512	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:11 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{4CFB60C1-FAA6-47f1-89AA-0B18730C9FD3}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	66	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2512	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:11 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{4B7C3B0F-E993-4E06-A241-3FBE06943684}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	65	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2512	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:11 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{42B5FAAE-6536-11d2-AE5A-0000F87571E3}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	64	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2512	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:11 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{3A0DBA37-F8B2-4356-83DE-3E90BD5C261F}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	63	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2512	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:11 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{2BFCC077-22D2-48DE-BDE1-2F618D9B476D}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	62	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2512	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:11 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{25537BA6-77A8-11D2-9B6C-0000F8080861}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	61	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2512	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:11 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{1A6364EB-776B-4120-ADE1-B63A406A76B5}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	60	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2512	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:11 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{17D89FEC-5C44-4972-B12D-241CAEF74509}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	59	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2512	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:11 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{169EBF44-942F-4C43-87CE-13C93996EBBE}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	58	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2512	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:11 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{0E28E245-9368-4853-AD84-6DA3BA35BB75}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	57	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2512	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:11 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WMIProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2768; ProviderPath = %systemroot%\system32\wbem\wmiprov.dll	5857	0	4611686018427387904	56	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2768	1124	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:11 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WMIProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2768; ProviderPath = %systemroot%\system32\wbem\wmiprov.dll	5857	0	4611686018427387904	55	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2768	1124	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:11 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{FC491EF1-C4AA-4CE1-B329-414B101DB823}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	54	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2528	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:09 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{fbf687e6-f063-4d9f-9f4f-fd9a26acdd5f}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	53	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2528	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:09 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{FB2CA36D-0B40-4307-821B-A13B252DE56C}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	52	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2528	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:09 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{f3ccc681-b74c-4060-9f26-cd84525dca2a}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	51	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2528	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:09 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{F312195E-3D9D-447A-A3F5-08DFFA24735E}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	50	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2528	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:09 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{E62688F0-25FD-4c90-BFF5-F508B9D2E31F}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	49	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2528	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:09 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{E5094040-C46C-4115-B030-04FB2E545B00}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	48	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2528	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:09 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{E4F48E54-F38D-4884-BFB9-D4D2E5729C18}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	47	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2528	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:09 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{e437bc1c-aa7d-11d2-a382-00c04f991e27}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	46	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2528	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:09 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{CF7639F3-ABA2-41DB-97F2-81E2C5DBFC5D}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	45	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2528	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:09 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{cdeafc3d-948d-49dd-ab12-e578ba4af7aa}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	44	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2528	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:09 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{c6dc5466-785a-11d2-84d0-00c04fb169f7}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	43	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2528	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:09 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{C631DF4C-088F-4156-B058-4375F0853CD8}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	42	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2528	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:09 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{C418DD9D-0D14-4efb-8FBF-CFE535C8FAC7}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	41	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2528	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:09 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{C34B2751-1CF4-44F5-9262-C3FC39666591}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	40	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2528	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:09 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{BC75B1ED-5833-4858-9BB8-CBF0B166DF9D}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	39	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2528	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:09 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{BA649533-0AAC-4E04-B9BC-4DBAE0325B12}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	38	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2528	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:09 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{B587E2B1-4D59-4e7e-AED9-22B9DF11D053}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	37	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2528	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:09 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{B087BE9D-ED37-454f-AF9C-04291E351182}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	36	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2528	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:09 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{AADCED64-746C-4633-A97C-D61349046527}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	35	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2528	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:09 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{A3F3E39B-5D83-4940-B954-28315B82F0A8}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	34	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2528	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:09 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{91FBB303-0CD5-4055-BF42-E512A681B325}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	33	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2528	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:09 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{8A28E2C5-8D06-49A4-A08C-632DAA493E17}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	32	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2528	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:09 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{827D319E-6EAC-11D2-A4EA-00C04F79F83A}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	31	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2528	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:09 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{7B849a69-220F-451E-B3FE-2CB811AF94AE}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	30	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2528	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:09 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{7933F41E-56F8-41d6-A31C-4148A711EE93}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	29	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2528	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:09 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{74EE6C03-5363-4554-B161-627540339CAB}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	28	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2528	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:09 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{728EE579-943C-4519-9EF7-AB56765798ED}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	27	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2528	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:09 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{7150F9BF-48AD-4da4-A49C-29EF4A8369BA}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	26	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2528	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:09 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{6A4C88C6-C502-4f74-8F60-2CB23EDC24E2}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	25	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2528	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:09 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{6232C319-91AC-4931-9385-E70C2B099F0E}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	24	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2528	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:09 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{4CFB60C1-FAA6-47f1-89AA-0B18730C9FD3}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	23	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2528	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:09 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{4bcd6cde-777b-48b6-9804-43568e23545d}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	22	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2528	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:09 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{4B7C3B0F-E993-4E06-A241-3FBE06943684}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	21	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2528	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:09 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{42B5FAAE-6536-11d2-AE5A-0000F87571E3}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	20	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2528	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:09 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{426031c0-0b47-4852-b0ca-ac3d37bfcb39}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	19	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2528	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:09 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{3A0DBA37-F8B2-4356-83DE-3E90BD5C261F}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	18	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2528	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:09 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{3610eda5-77ef-11d2-8dc5-00c04fa31a66}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	17	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2528	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:09 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{2BFCC077-22D2-48DE-BDE1-2F618D9B476D}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	16	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2528	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:09 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{2A8FDC61-2347-4C87-92F6-B05EB91A201A}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	15	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2528	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:09 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{1A6364EB-776B-4120-ADE1-B63A406A76B5}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	14	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2528	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:09 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{17D89FEC-5C44-4972-B12D-241CAEF74509}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	13	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2528	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:09 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{16be69fa-4209-4250-88cb-716cf41954e0}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	12	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2528	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:09 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{169EBF44-942F-4C43-87CE-13C93996EBBE}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	11	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2528	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:09 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{0E28E245-9368-4853-AD84-6DA3BA35BB75}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	10	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2528	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:09 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{0ACDD40C-75AC-47ab-BAA0-BF6DE7E7FE63}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	9	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2528	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:09 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{35378EAC-683F-11D2-A89A-00C04FBBCFA2}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	8	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2528	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:09 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3440; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll	5857	0	4611686018427387904	7	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	3440	3468	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:09 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
ServerFeatureProvider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2856; ProviderPath = %windir%\system32\wbem\servercompprov.dll	5857	0	4611686018427387904	6	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2856	3084	WIN-5T344G8GM1H	S-1-5-20	1/16/2018 5:02:09 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 2972; Component = Unknown; Operation = Start IWbemServices::ExecQuery - ROOT\CIMV2 : select ChassisTypes from Win32_SystemEnclosure; ResultCode = 0x80041032; PossibleCause = Unknown	5858	2	4611686018427387904	5	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2484	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:09 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32a provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2856; ProviderPath = %systemroot%\system32\wbem\wmipcima.dll	5857	0	4611686018427387904	4	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2856	3084	WIN-5T344G8GM1H	S-1-5-20	1/16/2018 5:02:06 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2856; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll	5857	0	4611686018427387904	3	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2856	2436	WIN-5T344G8GM1H	S-1-5-20	1/16/2018 5:02:05 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-PD8DQPRRTAO; User = NT AUTHORITY\SYSTEM; ClientProcessId = 2508; Component = Unknown; Operation = Start IWbemServices::CreateInstanceEnum - root\wmi : MSiSCSI_PortalInfoClass; ResultCode = 0x8004100A; PossibleCause = Unknown	5858	2	4611686018427387904	2	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	916	2392	WIN-PD8DQPRRTAO	S-1-5-18	1/16/2018 5:01:40 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-PD8DQPRRTAO; User = NT AUTHORITY\SYSTEM; ClientProcessId = 2508; Component = Unknown; Operation = Start IWbemServices::CreateInstanceEnum - root\wmi : MS_SM_AdapterInformationQuery; ResultCode = 0x8004100A; PossibleCause = Unknown	5858	2	4611686018427387904	1	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	916	2392	WIN-PD8DQPRRTAO	S-1-5-18	1/16/2018 5:01:40 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]