MessageIdVersionQualifiersLevelTaskOpcodeKeywordsRecordIdProviderNameProviderIdLogNameProcessIdThreadIdMachineNameUserIdTimeCreatedActivityIdRelatedActivityIdContainerLogMatchedQueryIdsBookmarkLevelDisplayNameOpcodeDisplayNameTaskDisplayNameKeywordsDisplayNamesProperties
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4416; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll585700004611686018427387904842Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational44161172hv-cinder-81722S-1-5-2011/9/2021 3:43:48 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 5064; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll585700004611686018427387904841Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational50644424hv-cinder-81722S-1-5-1811/9/2021 3:39:17 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4416; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll585700004611686018427387904840Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational44161908hv-cinder-81722S-1-5-2011/9/2021 3:39:17 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {A9D54872-CBA2-42E0-AB26-059EB816B3D8}; ClientMachine = HV-CINDER-81722; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3780; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1107766483; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904839Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5521960hv-cinder-81722S-1-5-1811/9/2021 3:38:52 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {4E143529-8AA0-442A-A6A6-65DAD0965F10}; ClientMachine = HV-CINDER-81722; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3780; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Host.HostName="iqn.2010-10.org.openstack:volume-bec7a88d-510c-4c99-9c22-84ebc5925d3e"; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904838Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5522484hv-cinder-81722S-1-5-1811/9/2021 3:38:52 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {A26AA481-CD8D-470D-A678-EDF2C3479ECE}; ClientMachine = HV-CINDER-81722; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3780; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_IDMethod.HostName="iqn.2010-10.org.openstack:volume-bec7a88d-510c-4c99-9c22-84ebc5925d3e",Method=4,Value="iqn.1991-05.com.microsoft:hv-cinder-81722"; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904837Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5521960hv-cinder-81722S-1-5-1811/9/2021 3:38:52 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WinTargetProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1984; ProviderPath = C:\windows\system32\wbem\WTWMIProv.dll585700004611686018427387904836Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational19844496hv-cinder-81722S-1-5-1911/9/2021 3:38:52 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
StorageWMI provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4416; ProviderPath = %SystemRoot%\System32\storagewmi.dll585700004611686018427387904835Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational44161908hv-cinder-81722S-1-5-2011/9/2021 3:38:50 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {723B4F41-FBF2-43AF-8E56-9EDCEC5D5DF0}; ClientMachine = HV-CINDER-81722; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3780; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1450564573; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904834Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5523084hv-cinder-81722S-1-5-1811/9/2021 3:37:49 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {219B5F69-0C73-4281-94DD-F44ECB43D6A0}; ClientMachine = HV-CINDER-81722; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3780; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=2081120172; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904833Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5523084hv-cinder-81722S-1-5-1811/9/2021 3:37:48 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FC4694E8-2B0A-42F2-8FCD-8FFD5F0C55BF}; ClientMachine = HV-CINDER-81722; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3780; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1662890952; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904832Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5522888hv-cinder-81722S-1-5-1811/9/2021 3:37:47 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {85D6C5E5-821D-4B12-ACE1-61E109F235AD}; ClientMachine = HV-CINDER-81722; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3780; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{0FD1C7F5-90C9-4C20-AECD-55CA709F39F8}"; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904831Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5523084hv-cinder-81722S-1-5-1811/9/2021 3:37:46 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {347B6EEC-F59E-4ADF-9893-B888AA22D972}; ClientMachine = HV-CINDER-81722; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3780; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Host.HostName="iqn.2010-10.org.openstack:volume-0ee363f2-ed5d-4fc5-8abd-570e09c16a29"; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904830Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5523084hv-cinder-81722S-1-5-1811/9/2021 3:37:45 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {3767C471-14D8-42E8-8E7E-2EDCCE4CD4CF}; ClientMachine = HV-CINDER-81722; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3780; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_IDMethod.HostName="iqn.2010-10.org.openstack:volume-0ee363f2-ed5d-4fc5-8abd-570e09c16a29",Method=4,Value="iqn.1991-05.com.microsoft:hv-cinder-81722"; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904829Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5524672hv-cinder-81722S-1-5-1811/9/2021 3:37:45 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {723EEA78-87FF-4228-98E2-EB860D22D1E0}; ClientMachine = HV-CINDER-81722; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3780; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{849CBFEE-A224-41AF-B384-DFEBE417997B}"; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904828Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5523084hv-cinder-81722S-1-5-1811/9/2021 3:37:26 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {5496E08C-1181-4A02-8D3D-6EB5E5673932}; ClientMachine = HV-CINDER-81722; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3780; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=2024424514; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904827Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5523084hv-cinder-81722S-1-5-1811/9/2021 3:37:25 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {58750378-7A57-4192-9285-06610EB74A75}; ClientMachine = HV-CINDER-81722; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3780; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Host.HostName="iqn.2010-10.org.openstack:volume-be12a47b-bf63-482c-a7a4-ea1e3e5a5a3c"; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904826Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5523084hv-cinder-81722S-1-5-1811/9/2021 3:37:23 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {505E4190-4637-4A16-9123-84349CA102A2}; ClientMachine = HV-CINDER-81722; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3780; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_IDMethod.HostName="iqn.2010-10.org.openstack:volume-be12a47b-bf63-482c-a7a4-ea1e3e5a5a3c",Method=4,Value="iqn.1991-05.com.microsoft:hv-cinder-81722"; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904825Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5522888hv-cinder-81722S-1-5-1811/9/2021 3:37:23 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {BF71BD11-655A-48E8-9ADB-83BE2A2307D4}; ClientMachine = HV-CINDER-81722; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3780; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1544379729; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904824Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5523084hv-cinder-81722S-1-5-1811/9/2021 3:37:07 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {0AEDF9B7-D2BA-4F52-8DE7-2FAF38987E05}; ClientMachine = HV-CINDER-81722; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3780; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1462749271; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904823Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5524896hv-cinder-81722S-1-5-1811/9/2021 3:37:04 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {5BCE12C5-DA94-4F61-9DEA-E16E0FE1FA7B}; ClientMachine = HV-CINDER-81722; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3780; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=532811163; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904822Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5524768hv-cinder-81722S-1-5-1811/9/2021 3:36:55 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {8198B18B-9334-41E4-AA3E-E6538DD860C1}; ClientMachine = HV-CINDER-81722; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3780; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Host.HostName="iqn.2010-10.org.openstack:volume-bec7a88d-510c-4c99-9c22-84ebc5925d3e"; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904821Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5524768hv-cinder-81722S-1-5-1811/9/2021 3:36:51 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {025C2333-64D6-4E26-8592-522068ACFDF9}; ClientMachine = HV-CINDER-81722; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3780; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_IDMethod.HostName="iqn.2010-10.org.openstack:volume-bec7a88d-510c-4c99-9c22-84ebc5925d3e",Method=4,Value="iqn.1991-05.com.microsoft:hv-cinder-81722"; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904820Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5524768hv-cinder-81722S-1-5-1811/9/2021 3:36:51 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
StorageWMI provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4416; ProviderPath = %SystemRoot%\System32\storagewmi.dll585700004611686018427387904819Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational44161908hv-cinder-81722S-1-5-2011/9/2021 3:36:51 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {2EC74218-564B-4E79-8964-EB0CC0458570}; ClientMachine = HV-CINDER-81722; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3780; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1996296415; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904818Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5524768hv-cinder-81722S-1-5-1811/9/2021 3:36:46 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {B0523B98-657D-4472-B8A6-ADB43F7BCEBB}; ClientMachine = HV-CINDER-81722; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3780; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1675830803; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904817Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5524768hv-cinder-81722S-1-5-1811/9/2021 3:36:42 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
MSVSS__PROVIDER provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4416; ProviderPath = %systemroot%\system32\wbem\vsswmi.dll585700004611686018427387904816Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational44161908hv-cinder-81722S-1-5-2011/9/2021 3:36:41 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {188D66ED-E217-485A-BE72-DBFF3163CFBE}; ClientMachine = HV-CINDER-81722; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3780; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1073099530; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904815Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5524324hv-cinder-81722S-1-5-1811/9/2021 3:36:26 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {AC3A8F86-B039-4CF4-ABC8-2AA6D7720585}; ClientMachine = HV-CINDER-81722; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3780; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{C2F4C0FF-8E22-4846-A8C7-91485E2EA4A8}"; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904814Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5523084hv-cinder-81722S-1-5-1811/9/2021 3:36:24 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {D9345E01-0DFD-4E30-9FAB-5F426024311C}; ClientMachine = HV-CINDER-81722; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3780; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1197978732; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904813Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5523084hv-cinder-81722S-1-5-1811/9/2021 3:36:20 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {865ABF0E-3ED3-4B3A-AC4C-0F9C9EA0CA35}; ClientMachine = HV-CINDER-81722; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3780; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1922206674; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904812Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5522484hv-cinder-81722S-1-5-1811/9/2021 3:36:18 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {2ADBDBCE-B1A6-44B8-89CF-E2188BD08246}; ClientMachine = HV-CINDER-81722; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3780; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1216581510; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904811Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5523084hv-cinder-81722S-1-5-1811/9/2021 3:36:07 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {D9DBA781-282D-4122-AB39-807F964F4620}; ClientMachine = HV-CINDER-81722; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4480; Component = Unknown; Operation = Start IWbemServices::GetObject - root\virtualization\v2 : \\.\ROOT\virtualization\v2:Msvm_VirtualSystemSettingData.InstanceID="Microsoft:0E1BC976-AD14-48C0-8B6B-E9029FDA2675"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904810Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5521960hv-cinder-81722S-1-5-1811/9/2021 3:36:00 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {49CCBFC7-9551-4633-93B0-567D35F109F0}; ClientMachine = HV-CINDER-81722; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3780; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1077377950; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904809Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5523084hv-cinder-81722S-1-5-1811/9/2021 3:35:55 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {8ED7AD77-62CC-4000-9412-8A52E072BDBF}; ClientMachine = HV-CINDER-81722; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3780; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{04D68206-A031-4A22-A531-70BF942BED14}"; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904808Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5521960hv-cinder-81722S-1-5-1811/9/2021 3:35:54 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {F6DF39E7-0DE9-4CD6-94BF-88772432C158}; ClientMachine = HV-CINDER-81722; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3780; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{B4556703-0464-4A62-98A5-7AB70C2F52AB}"; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904807Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5524896hv-cinder-81722S-1-5-1811/9/2021 3:35:52 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {EBE04246-82FA-4385-B49E-7F8934799EB7}; ClientMachine = HV-CINDER-81722; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3780; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{5D967D03-4F05-4839-B85D-46BFF512E647}"; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904806Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5523084hv-cinder-81722S-1-5-1811/9/2021 3:35:51 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {B33AFCC7-5C65-4182-AA34-01537A0299E4}; ClientMachine = HV-CINDER-81722; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3780; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1713956010; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904805Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5521960hv-cinder-81722S-1-5-1811/9/2021 3:35:32 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {A156B5CB-74DF-431B-A0AE-D51C29E5EAAC}; ClientMachine = HV-CINDER-81722; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3780; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=414277915; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904804Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5521960hv-cinder-81722S-1-5-1811/9/2021 3:35:25 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
StorageWMI provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4416; ProviderPath = %SystemRoot%\System32\storagewmi.dll585700004611686018427387904803Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational44161908hv-cinder-81722S-1-5-2011/9/2021 3:35:20 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {46F68C1C-9530-440A-B8F6-1D5E8D091EA5}; ClientMachine = HV-CINDER-81722; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3780; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=2143469473; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904802Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5524672hv-cinder-81722S-1-5-1811/9/2021 3:35:12 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {193CC79A-1BA6-4E32-AFE9-2448D9A8A346}; ClientMachine = HV-CINDER-81722; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3780; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{5B6E3B2B-26B5-438B-92A6-E3572FCB515F}"; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904801Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5524672hv-cinder-81722S-1-5-1811/9/2021 3:35:10 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {B9221A21-EF1B-4813-A013-8F3A754B50B2}; ClientMachine = HV-CINDER-81722; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3780; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{28E0E796-32DD-497D-9CC2-47FAF20FE02D}"; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904800Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5524672hv-cinder-81722S-1-5-1811/9/2021 3:35:08 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {56C8E716-A5EC-41FE-A5E9-BA4858F499B7}; ClientMachine = HV-CINDER-81722; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3780; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=2069753863; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904799Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5523084hv-cinder-81722S-1-5-1811/9/2021 3:35:02 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {A09AB356-4F76-4353-BE6F-B34D59C5D321}; ClientMachine = HV-CINDER-81722; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3780; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{16AA3C81-690F-46B6-87C1-5BA04C8D7808}"; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904798Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5524672hv-cinder-81722S-1-5-1811/9/2021 3:35:02 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {E1AA6689-AC81-46A1-B221-4622DB842299}; ClientMachine = HV-CINDER-81722; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3780; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{278BC0D7-A38E-4534-BD3A-3F52CC69B24D}"; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904797Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5524672hv-cinder-81722S-1-5-1811/9/2021 3:34:55 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {F5248D6B-B426-4D15-AA94-63F4E2EE958C}; ClientMachine = HV-CINDER-81722; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3780; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1159392173; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904796Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5524672hv-cinder-81722S-1-5-1811/9/2021 3:34:54 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {B2B6CA4B-794E-4906-A0FD-2E00BDD273CB}; ClientMachine = HV-CINDER-81722; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3780; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=894160825; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904795Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5524672hv-cinder-81722S-1-5-1811/9/2021 3:34:50 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {20878466-595F-4A76-9DF7-D12EC842BD9A}; ClientMachine = HV-CINDER-81722; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3780; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1900036649; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904794Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational552768hv-cinder-81722S-1-5-1811/9/2021 3:34:48 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {C94443AA-6EBA-401B-8D88-08B81B252C4E}; ClientMachine = HV-CINDER-81722; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3780; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{7402733C-D8C8-4C21-AC05-61EE7D99D74D}"; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904793Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5524896hv-cinder-81722S-1-5-1811/9/2021 3:34:47 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {60739ACA-1007-4E71-B5B7-51563D9D666C}; ClientMachine = HV-CINDER-81722; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3780; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{CE34F0D0-8C8F-41CA-B55F-404B5B5FACF8}"; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904792Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational552768hv-cinder-81722S-1-5-1811/9/2021 3:34:47 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {DAC35F1E-5594-499A-965D-4B7B09A3D5B3}; ClientMachine = HV-CINDER-81722; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3780; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=611797333; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904791Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5524324hv-cinder-81722S-1-5-1811/9/2021 3:34:43 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {E014C30F-F77D-400C-9176-A641214877E0}; ClientMachine = HV-CINDER-81722; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3780; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=860276104; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904790Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational552768hv-cinder-81722S-1-5-1811/9/2021 3:34:25 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {BD3BAB42-88B1-459D-B0B1-7786F7C50399}; ClientMachine = HV-CINDER-81722; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3780; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{370AC543-8D86-45A8-96CC-41AD60F06E0C}"; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904789Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5524768hv-cinder-81722S-1-5-1811/9/2021 3:34:23 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {1CAA961F-3FFC-4EC5-8BEB-90ACD0EB7D31}; ClientMachine = HV-CINDER-81722; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3780; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=2112596090; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904788Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5524492hv-cinder-81722S-1-5-1811/9/2021 3:34:23 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {5CFA8806-296B-45E3-8445-2A5F7F59C219}; ClientMachine = HV-CINDER-81722; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3780; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1894694781; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904787Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5524768hv-cinder-81722S-1-5-1811/9/2021 3:34:19 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {DBCA8A22-5DA9-4E69-B6EC-D83444369FD2}; ClientMachine = HV-CINDER-81722; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3780; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=259145715; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904786Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5524492hv-cinder-81722S-1-5-1811/9/2021 3:34:18 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {6853805A-102E-4670-9863-F618E24AEF23}; ClientMachine = HV-CINDER-81722; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3780; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=146151587; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904785Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational552768hv-cinder-81722S-1-5-1811/9/2021 3:34:15 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {602966A0-DD34-41F0-ABC8-104D92E81829}; ClientMachine = HV-CINDER-81722; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3780; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=860110247; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904784Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5523084hv-cinder-81722S-1-5-1811/9/2021 3:34:15 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {2B7BD590-5DAF-4862-8156-259B6C87E8AD}; ClientMachine = HV-CINDER-81722; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3780; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{EF881B53-29D1-4D9B-B73A-CC068FE50671}"; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904783Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5523084hv-cinder-81722S-1-5-1811/9/2021 3:34:13 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {27FC49C8-564B-47AA-B0E7-7E8AD31AB97B}; ClientMachine = HV-CINDER-81722; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3780; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{5579FC46-C192-49E5-82DA-AF15457100CC}"; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904782Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5524896hv-cinder-81722S-1-5-1811/9/2021 3:34:13 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {B0093AF0-3DFC-4FAF-9B69-D40DCC63A666}; ClientMachine = HV-CINDER-81722; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3780; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1032501672; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904781Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5524324hv-cinder-81722S-1-5-1811/9/2021 3:34:01 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {5FCB7228-F6FE-432C-AE24-513C994B56E9}; ClientMachine = HV-CINDER-81722; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3780; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1338480717; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904780Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5523084hv-cinder-81722S-1-5-1811/9/2021 3:33:59 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {88195322-4F23-4C8E-88FB-979C8ADC928E}; ClientMachine = HV-CINDER-81722; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3780; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1636833223; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904779Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5524896hv-cinder-81722S-1-5-1811/9/2021 3:33:58 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {6445424C-9471-4E50-9B57-54B2EED9CE1E}; ClientMachine = HV-CINDER-81722; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3780; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=211727600; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904778Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5524324hv-cinder-81722S-1-5-1811/9/2021 3:33:54 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {F282209D-8843-4DF2-939C-8D65658AE358}; ClientMachine = HV-CINDER-81722; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3780; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{BF1158F8-9851-4D5D-A93F-C7AF28FA0D88}"; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904777Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5523084hv-cinder-81722S-1-5-1811/9/2021 3:33:52 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {AF9E194B-A224-4A06-8A4A-81788FADF599}; ClientMachine = HV-CINDER-81722; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3780; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=577893380; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904776Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5524324hv-cinder-81722S-1-5-1811/9/2021 3:33:51 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9A4B5236-D368-4304-8BCE-A248FB05751E}; ClientMachine = HV-CINDER-81722; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3780; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1501022181; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904775Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5524492hv-cinder-81722S-1-5-1811/9/2021 3:33:49 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {ADEC8C8E-5B39-4264-8653-BDB2BE4DAE3C}; ClientMachine = HV-CINDER-81722; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3780; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Host.HostName="iqn.2010-10.org.openstack:volume-4e045719-c074-4b98-ad72-5c936dd5ed12"; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904774Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5524492hv-cinder-81722S-1-5-1811/9/2021 3:33:48 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {F1273881-EF40-4830-A037-690BD5B29ADC}; ClientMachine = HV-CINDER-81722; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3780; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_IDMethod.HostName="iqn.2010-10.org.openstack:volume-4e045719-c074-4b98-ad72-5c936dd5ed12",Method=4,Value="iqn.1991-05.com.microsoft:hv-cinder-81722"; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904773Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5524492hv-cinder-81722S-1-5-1811/9/2021 3:33:48 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {444FAF7D-B181-438D-94DD-84D794749364}; ClientMachine = HV-CINDER-81722; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3780; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Host.HostName="iqn.2010-10.org.openstack:volume-4aa1f420-25b5-48f1-a8f6-61d15ce173bf"; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904772Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5523084hv-cinder-81722S-1-5-1811/9/2021 3:33:44 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {440A9FFC-092B-4F8F-ADAF-7BA3DB2689E0}; ClientMachine = HV-CINDER-81722; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3780; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_IDMethod.HostName="iqn.2010-10.org.openstack:volume-4aa1f420-25b5-48f1-a8f6-61d15ce173bf",Method=4,Value="iqn.1991-05.com.microsoft:hv-cinder-81722"; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904771Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5524768hv-cinder-81722S-1-5-1811/9/2021 3:33:44 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {05BB3FF8-AD39-4E14-8101-A27D6944E157}; ClientMachine = HV-CINDER-81722; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3780; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1553034247; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904770Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5524896hv-cinder-81722S-1-5-1811/9/2021 3:33:16 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {BA28CF33-8D3B-4F88-A073-AC7DC9A2023D}; ClientMachine = HV-CINDER-81722; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3780; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1116257578; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904769Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5524324hv-cinder-81722S-1-5-1811/9/2021 3:33:12 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {7AA35A4D-F2D4-4C98-92F6-AD3206D6B3C0}; ClientMachine = HV-CINDER-81722; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3780; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Host.HostName="iqn.2010-10.org.openstack:volume-5a8cbd78-05c6-4c3c-baaa-d2a48f3dbfe4"; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904768Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5524324hv-cinder-81722S-1-5-1811/9/2021 3:33:10 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {161D1F36-BE31-4A24-8523-6B803EA58CC9}; ClientMachine = HV-CINDER-81722; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3780; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_IDMethod.HostName="iqn.2010-10.org.openstack:volume-5a8cbd78-05c6-4c3c-baaa-d2a48f3dbfe4",Method=4,Value="iqn.1991-05.com.microsoft:hv-cinder-81722"; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904767Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5524324hv-cinder-81722S-1-5-1811/9/2021 3:33:10 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {779F786B-D67C-4455-AB90-9A68421EDADC}; ClientMachine = HV-CINDER-81722; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3780; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1686804663; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904766Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational552768hv-cinder-81722S-1-5-1811/9/2021 3:33:02 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {F96F9253-3AAB-40BA-9B68-471D227D40B7}; ClientMachine = HV-CINDER-81722; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3780; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1939092767; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904765Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5524672hv-cinder-81722S-1-5-1811/9/2021 3:32:55 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {5A47114F-D928-4476-A9B4-CC737B40AD7F}; ClientMachine = HV-CINDER-81722; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3780; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Host.HostName="iqn.2010-10.org.openstack:volume-0f4ce673-9024-4f17-9325-8c2e551887e7"; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904764Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational552768hv-cinder-81722S-1-5-1811/9/2021 3:32:54 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {30AC0B14-B254-4207-9321-5CEA4196CD8F}; ClientMachine = HV-CINDER-81722; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3780; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_IDMethod.HostName="iqn.2010-10.org.openstack:volume-0f4ce673-9024-4f17-9325-8c2e551887e7",Method=4,Value="iqn.1991-05.com.microsoft:hv-cinder-81722"; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904763Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational552768hv-cinder-81722S-1-5-1811/9/2021 3:32:54 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {F2C5F26F-22AA-459B-953D-4337594BECEA}; ClientMachine = HV-CINDER-81722; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3780; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1584475358; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904762Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5521824hv-cinder-81722S-1-5-1811/9/2021 3:32:53 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {2874D9FB-0AE9-4EFB-8FB4-67314DD9DF4A}; ClientMachine = HV-CINDER-81722; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3780; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1071412865; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904761Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5524896hv-cinder-81722S-1-5-1811/9/2021 3:32:52 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {A88B8D15-0FB5-40A9-9433-28CF9B4674FF}; ClientMachine = HV-CINDER-81722; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3780; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=418429068; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904760Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5524672hv-cinder-81722S-1-5-1811/9/2021 3:32:50 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {70EF11DF-A02A-416B-8F3F-941F708311DA}; ClientMachine = HV-CINDER-81722; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3780; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{CB0C1620-18C8-4C00-A7E5-2A8CF192BCCB}"; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904759Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5524672hv-cinder-81722S-1-5-1811/9/2021 3:32:49 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {41C52AD6-371C-4C79-A5C2-32F54826311C}; ClientMachine = HV-CINDER-81722; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3780; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=497144287; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904758Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5523084hv-cinder-81722S-1-5-1811/9/2021 3:32:47 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {94C85FCB-5CB5-4109-A11B-BA9072DE49B4}; ClientMachine = HV-CINDER-81722; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3780; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{7986A14D-7D04-44C8-85EC-CA5639790C10}"; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904757Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5523084hv-cinder-81722S-1-5-1811/9/2021 3:32:46 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {5B86BCDA-5698-4470-B292-AB8C32251E59}; ClientMachine = HV-CINDER-81722; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3780; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=2016451932; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904756Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5523084hv-cinder-81722S-1-5-1811/9/2021 3:32:45 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {5F2BC18C-6BBB-4803-8DFA-6352F8F47884}; ClientMachine = HV-CINDER-81722; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3780; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1852525422; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904755Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5521960hv-cinder-81722S-1-5-1811/9/2021 3:32:44 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {871F39A4-B3A4-44FE-9C26-E5C0D15F9BCF}; ClientMachine = HV-CINDER-81722; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3780; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Host.HostName="iqn.2010-10.org.openstack:volume-42811014-3475-4342-be84-bfca0ee98cbe"; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904754Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5521960hv-cinder-81722S-1-5-1811/9/2021 3:32:43 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {2DF56A7D-D1B6-494A-A5E4-F732B7653902}; ClientMachine = HV-CINDER-81722; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3780; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_IDMethod.HostName="iqn.2010-10.org.openstack:volume-42811014-3475-4342-be84-bfca0ee98cbe",Method=4,Value="iqn.1991-05.com.microsoft:hv-cinder-81722"; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904753Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5524896hv-cinder-81722S-1-5-1811/9/2021 3:32:43 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {B882F3F6-4270-47E9-80FD-9FC48C43E69E}; ClientMachine = HV-CINDER-81722; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3780; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1758450139; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904752Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5523084hv-cinder-81722S-1-5-1811/9/2021 3:32:36 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {7F1B407A-ABF3-4BC0-9E01-7B0E5A2EC898}; ClientMachine = HV-CINDER-81722; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3780; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=184702557; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904751Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5523084hv-cinder-81722S-1-5-1811/9/2021 3:32:35 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {BF5902AD-8B08-486D-A4C3-DF7C122BA12B}; ClientMachine = HV-CINDER-81722; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3780; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Host.HostName="iqn.2010-10.org.openstack:volume-0ee363f2-ed5d-4fc5-8abd-570e09c16a29"; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904750Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5523084hv-cinder-81722S-1-5-1811/9/2021 3:32:24 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {DCBED9B5-FF61-4C49-A580-EF1215829DF0}; ClientMachine = HV-CINDER-81722; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3780; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_IDMethod.HostName="iqn.2010-10.org.openstack:volume-0ee363f2-ed5d-4fc5-8abd-570e09c16a29",Method=4,Value="iqn.1991-05.com.microsoft:hv-cinder-81722"; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904749Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5524324hv-cinder-81722S-1-5-1811/9/2021 3:32:24 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {806071FF-4612-4273-BEB4-DC79B0DC9C31}; ClientMachine = HV-CINDER-81722; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3780; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Host.HostName="iqn.2010-10.org.openstack:volume-9d1ff33b-d2fc-4b35-898f-8bd3fd6d472c"; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904748Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5524768hv-cinder-81722S-1-5-1811/9/2021 3:32:20 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {6ABEEF46-1D1B-438E-8AFE-9FAABED69D6A}; ClientMachine = HV-CINDER-81722; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3780; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_IDMethod.HostName="iqn.2010-10.org.openstack:volume-9d1ff33b-d2fc-4b35-898f-8bd3fd6d472c",Method=4,Value="iqn.1991-05.com.microsoft:hv-cinder-81722"; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904747Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5524324hv-cinder-81722S-1-5-1811/9/2021 3:32:20 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {CC152C8F-D92D-456E-B515-FEC23426B74E}; ClientMachine = HV-CINDER-81722; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3780; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Host.HostName="iqn.2010-10.org.openstack:volume-bdccf211-ef67-47a1-b59b-d528166a222f"; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904746Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational552768hv-cinder-81722S-1-5-1811/9/2021 3:32:18 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {0319212B-BFE3-4BF8-B8D6-B334CC41A941}; ClientMachine = HV-CINDER-81722; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3780; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_IDMethod.HostName="iqn.2010-10.org.openstack:volume-bdccf211-ef67-47a1-b59b-d528166a222f",Method=4,Value="iqn.1991-05.com.microsoft:hv-cinder-81722"; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904745Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5524672hv-cinder-81722S-1-5-1811/9/2021 3:32:18 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {6DDAB90C-9E26-49DD-9CB2-F69495D10A4A}; ClientMachine = HV-CINDER-81722; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3780; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{46645773-BE91-465F-BCC5-08F1DD45D06C}"; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904744Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational552768hv-cinder-81722S-1-5-1811/9/2021 3:32:17 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9E5D58B3-B458-4A4A-AAC4-C52246E8780E}; ClientMachine = HV-CINDER-81722; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3780; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{918B595E-10E0-4905-BF42-349851312E79}"; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904743Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5524324hv-cinder-81722S-1-5-1811/9/2021 3:32:16 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {81DC5D4D-CF55-4057-952D-CEB819DCE9C7}; ClientMachine = HV-CINDER-81722; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3780; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{D7435418-A394-4F25-9460-203D06100D34}"; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904742Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5524324hv-cinder-81722S-1-5-1811/9/2021 3:32:15 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
MSVSS__PROVIDER provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4416; ProviderPath = %systemroot%\system32\wbem\vsswmi.dll585700004611686018427387904741Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational44161172hv-cinder-81722S-1-5-2011/9/2021 3:32:03 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {64762C47-8B4B-4C55-B6EA-8372D599C44C}; ClientMachine = HV-CINDER-81722; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4480; Component = Unknown; Operation = Start IWbemServices::GetObject - root\virtualization\v2 : \\.\ROOT\virtualization\v2:Msvm_VirtualSystemSettingData.InstanceID="Microsoft:1A45F05A-EFDF-4057-A62F-E5DCC1EE04F5"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904740Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5524952hv-cinder-81722S-1-5-1811/9/2021 3:31:47 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {95767DE3-BFB1-4676-86E1-A7B856E797C7}; ClientMachine = HV-CINDER-81722; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3780; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Host.HostName="iqn.2010-10.org.openstack:volume-9bf56f7c-3e12-43e4-8f4e-e1f4eb86c687"; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904739Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5524896hv-cinder-81722S-1-5-1811/9/2021 3:31:47 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {5A90A619-FEC2-42C9-80B9-24D7CF4BF8A0}; ClientMachine = HV-CINDER-81722; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3780; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_IDMethod.HostName="iqn.2010-10.org.openstack:volume-9bf56f7c-3e12-43e4-8f4e-e1f4eb86c687",Method=4,Value="iqn.1991-05.com.microsoft:hv-cinder-81722"; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904738Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational552768hv-cinder-81722S-1-5-1811/9/2021 3:31:47 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {82E11C04-3854-4B42-BBAD-40F0D76DE024}; ClientMachine = HV-CINDER-81722; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3780; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{A4511241-541E-416C-AF7B-5AC1D3E7D32C}"; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904737Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational552104hv-cinder-81722S-1-5-1811/9/2021 3:31:37 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {46EBA377-034A-4E4D-A512-DE0733204144}; ClientMachine = HV-CINDER-81722; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3780; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Host.HostName="iqn.2010-10.org.openstack:volume-aa14b8cc-8efb-4d99-8bb3-c2692bad4a1f"; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904736Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5521960hv-cinder-81722S-1-5-1811/9/2021 3:31:26 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FA71FA8C-15E6-42D6-89BF-FA35DFDEF577}; ClientMachine = HV-CINDER-81722; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3780; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_IDMethod.HostName="iqn.2010-10.org.openstack:volume-aa14b8cc-8efb-4d99-8bb3-c2692bad4a1f",Method=4,Value="iqn.1991-05.com.microsoft:hv-cinder-81722"; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904735Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5524324hv-cinder-81722S-1-5-1811/9/2021 3:31:26 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {262D244B-DAC5-42B4-9B46-4C38C160914A}; ClientMachine = HV-CINDER-81722; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3780; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{17854FEE-68A3-4901-B4F4-3A00DA8BC3A1}"; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904734Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5521960hv-cinder-81722S-1-5-1811/9/2021 3:31:22 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {4177B6AF-3228-4B9A-9C43-DB7E104DA7C2}; ClientMachine = HV-CINDER-81722; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3780; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{B103CA0B-C431-48C1-93B3-82B856C81277}"; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904733Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5524896hv-cinder-81722S-1-5-1811/9/2021 3:31:20 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {97DCA579-1F40-499D-96E8-0CF357452585}; ClientMachine = HV-CINDER-81722; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3780; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{964E1F2D-41B4-4073-AAEF-4C31CC7AD9A9}"; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904732Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5521824hv-cinder-81722S-1-5-1811/9/2021 3:31:19 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {DF8447A1-30C7-4A73-B433-EF81CD59D7FE}; ClientMachine = HV-CINDER-81722; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3780; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Host.HostName="iqn.2010-10.org.openstack:volume-707b05c3-4bde-4b6c-b627-07da947beddf"; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904731Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5524768hv-cinder-81722S-1-5-1811/9/2021 3:30:20 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {7B31CECD-B9F1-4173-AE1C-D89BD5D7013A}; ClientMachine = HV-CINDER-81722; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3780; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_IDMethod.HostName="iqn.2010-10.org.openstack:volume-707b05c3-4bde-4b6c-b627-07da947beddf",Method=4,Value="iqn.1991-05.com.microsoft:hv-cinder-81722"; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904730Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational552768hv-cinder-81722S-1-5-1811/9/2021 3:30:20 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {3D100E21-28D0-4817-8DC4-F4996E72A6E6}; ClientMachine = HV-CINDER-81722; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3780; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1389430046; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904729Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5523084hv-cinder-81722S-1-5-1811/9/2021 3:30:05 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {5AB34598-F017-4594-8735-67712451693A}; ClientMachine = HV-CINDER-81722; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3780; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=535851673; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904728Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5523084hv-cinder-81722S-1-5-1811/9/2021 3:30:02 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {74D38807-C03F-4DB3-9641-DEB3A08A2DB8}; ClientMachine = HV-CINDER-81722; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3780; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1970038605; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904727Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational552768hv-cinder-81722S-1-5-1811/9/2021 3:30:01 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {6FC70603-D29F-4AE5-AAE4-F2879EBC2447}; ClientMachine = HV-CINDER-81722; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3780; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Host.HostName="iqn.2010-10.org.openstack:volume-5aa6eaf7-2757-422b-b8d2-59733e3c9521"; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904726Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5524768hv-cinder-81722S-1-5-1811/9/2021 3:29:58 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {8F6AFB8E-07FA-4E6C-9779-F78146DCE005}; ClientMachine = HV-CINDER-81722; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3780; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_IDMethod.HostName="iqn.2010-10.org.openstack:volume-5aa6eaf7-2757-422b-b8d2-59733e3c9521",Method=4,Value="iqn.1991-05.com.microsoft:hv-cinder-81722"; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904725Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5524768hv-cinder-81722S-1-5-1811/9/2021 3:29:58 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {121223D7-FBF6-4AF9-95B5-DB5197B52AF4}; ClientMachine = HV-CINDER-81722; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3780; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1080913964; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904724Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5524768hv-cinder-81722S-1-5-1811/9/2021 3:29:57 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {D9FE26BA-2425-4DA5-A80E-71A36C6401DB}; ClientMachine = HV-CINDER-81722; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3780; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1588574658; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904723Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5524768hv-cinder-81722S-1-5-1811/9/2021 3:29:55 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {BC05E821-8314-4E27-B4DE-C50EFB60C91B}; ClientMachine = HV-CINDER-81722; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3780; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1671253511; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904722Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5521824hv-cinder-81722S-1-5-1811/9/2021 3:29:54 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {79F63B75-F94E-4102-A544-F05BD624FC74}; ClientMachine = HV-CINDER-81722; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3780; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1091907921; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904721Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5524896hv-cinder-81722S-1-5-1811/9/2021 3:29:52 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {65EFBA86-DA99-40A5-8314-C00E355E79C8}; ClientMachine = HV-CINDER-81722; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3780; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{B3F15AB4-FD9B-45AC-A658-672622A76EE7}"; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904720Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5524768hv-cinder-81722S-1-5-1811/9/2021 3:29:50 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {38B5F57F-A647-42CB-8620-45D8FDD2926B}; ClientMachine = HV-CINDER-81722; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3780; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=2144129776; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904719Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational552768hv-cinder-81722S-1-5-1811/9/2021 3:29:50 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {A08BC49B-B294-4818-A73A-D955E9A79592}; ClientMachine = HV-CINDER-81722; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3780; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{DE26916B-9A3A-403B-B09F-7EEB57B5C29F}"; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904718Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5524324hv-cinder-81722S-1-5-1811/9/2021 3:29:41 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {E12314B8-978A-4521-905D-E5CDBDCF2FDC}; ClientMachine = HV-CINDER-81722; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3780; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=273237997; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904717Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5521824hv-cinder-81722S-1-5-1811/9/2021 3:29:41 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {103CB089-7CC9-4E9C-A6E5-CEE571FCC678}; ClientMachine = HV-CINDER-81722; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3780; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1395601381; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904716Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5524768hv-cinder-81722S-1-5-1811/9/2021 3:29:16 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {CB452697-2B83-43A9-B7B5-AE083B61AB63}; ClientMachine = HV-CINDER-81722; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3780; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=668259222; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904715Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5524924hv-cinder-81722S-1-5-1811/9/2021 3:29:14 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {3229FD7B-2F5F-421C-84AF-86EF20A32C72}; ClientMachine = HV-CINDER-81722; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3780; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1894016103; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904714Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5524924hv-cinder-81722S-1-5-1811/9/2021 3:29:13 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {F1FA3916-1975-46F6-8ED7-B79EC063105E}; ClientMachine = HV-CINDER-81722; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3780; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1153976150; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904713Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5524492hv-cinder-81722S-1-5-1811/9/2021 3:29:08 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {772D5A8F-2884-41DD-9D9C-F51A9F241A26}; ClientMachine = HV-CINDER-81722; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3780; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{9DFD52F6-0609-48BB-80B4-6DE7C24031B0}"; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904712Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5524924hv-cinder-81722S-1-5-1811/9/2021 3:29:06 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {2E6640CF-6E53-4414-A648-7A76D5BD5273}; ClientMachine = HV-CINDER-81722; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3780; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1487010028; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904711Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5521824hv-cinder-81722S-1-5-1811/9/2021 3:29:02 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {59EAEC20-0EA4-4362-841E-CEB448348829}; ClientMachine = HV-CINDER-81722; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3780; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1039600989; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904710Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5522888hv-cinder-81722S-1-5-1811/9/2021 3:28:59 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {061C9D53-4514-49EF-89D3-AD7FD2D8E2E6}; ClientMachine = HV-CINDER-81722; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3780; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=707777138; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904709Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5524492hv-cinder-81722S-1-5-1811/9/2021 3:28:57 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {D69BD676-41B0-4F54-BC61-E53C2287FC56}; ClientMachine = HV-CINDER-81722; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3780; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1373492814; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904708Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5522888hv-cinder-81722S-1-5-1811/9/2021 3:28:55 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {022CE7A2-E570-4FC7-AEB9-5D7470C7D3BE}; ClientMachine = HV-CINDER-81722; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3780; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=2076986846; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904707Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational552768hv-cinder-81722S-1-5-1811/9/2021 3:28:53 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {0F8A3015-EE50-4F97-ABA5-9379FFFE1606}; ClientMachine = HV-CINDER-81722; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3780; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1900531464; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904706Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5522484hv-cinder-81722S-1-5-1811/9/2021 3:28:44 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {4328B5D0-A2ED-4413-B554-00139776797A}; ClientMachine = HV-CINDER-81722; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3780; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=346542756; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904705Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5522888hv-cinder-81722S-1-5-1811/9/2021 3:28:39 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {B37D7401-0E32-4683-989B-729A149756C2}; ClientMachine = HV-CINDER-81722; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3780; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=398015902; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904704Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational552768hv-cinder-81722S-1-5-1811/9/2021 3:28:24 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {06813190-561E-4464-A848-41DDBD9CA9A5}; ClientMachine = HV-CINDER-81722; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3780; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=909956878; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904703Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5524492hv-cinder-81722S-1-5-1811/9/2021 3:28:22 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {201C4082-36B1-4FD7-92CA-468BFF075A1C}; ClientMachine = HV-CINDER-81722; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3780; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=611987910; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904702Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5524672hv-cinder-81722S-1-5-1811/9/2021 3:28:21 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {04FCFE83-5C2D-4E4C-A388-91EF5427063A}; ClientMachine = HV-CINDER-81722; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3780; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=5550511; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904701Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational552768hv-cinder-81722S-1-5-1811/9/2021 3:28:21 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {D4C8F775-D49E-4056-86B3-DA94440981C4}; ClientMachine = HV-CINDER-81722; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3780; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=847243587; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904700Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational552768hv-cinder-81722S-1-5-1811/9/2021 3:28:19 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {F91DC935-BD68-4209-A2C6-0346B2CA767B}; ClientMachine = HV-CINDER-81722; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3780; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1035380345; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904699Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational552768hv-cinder-81722S-1-5-1811/9/2021 3:28:18 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9A6CF4DC-91AF-409A-B4F2-FAB0F143F229}; ClientMachine = HV-CINDER-81722; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3780; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{F1BE0D36-268F-4B84-A950-23CE16068010}"; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904698Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5522484hv-cinder-81722S-1-5-1811/9/2021 3:28:17 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {5BC841AE-90E7-4D6D-AFB7-E172316B6B3F}; ClientMachine = HV-CINDER-81722; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3780; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1968057463; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904697Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational552768hv-cinder-81722S-1-5-1811/9/2021 3:28:17 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {93C1E594-AEF8-4A58-8C0C-BD257152E414}; ClientMachine = HV-CINDER-81722; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3780; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1858492399; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904696Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5522484hv-cinder-81722S-1-5-1811/9/2021 3:28:17 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {D4060476-F312-44F7-A509-96A74C0E6E73}; ClientMachine = HV-CINDER-81722; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3780; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=694853575; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904695Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5524492hv-cinder-81722S-1-5-1811/9/2021 3:28:13 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {DAC9C3EA-1255-463F-A736-0F1FEE01F313}; ClientMachine = HV-CINDER-81722; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3780; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1217391506; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904694Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5524492hv-cinder-81722S-1-5-1811/9/2021 3:28:09 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {90FB3AF0-D493-465B-ADA3-6F578A0DFEA3}; ClientMachine = HV-CINDER-81722; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3780; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1561736519; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904693Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5522888hv-cinder-81722S-1-5-1811/9/2021 3:28:08 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {F0F28BFC-7B9C-4C37-AAE5-020630321D89}; ClientMachine = HV-CINDER-81722; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3780; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1149594859; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904692Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5522888hv-cinder-81722S-1-5-1811/9/2021 3:28:08 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {01138084-0A78-4E2E-8713-A1145AB3A2A1}; ClientMachine = HV-CINDER-81722; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3780; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1257215993; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904691Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5524672hv-cinder-81722S-1-5-1811/9/2021 3:28:07 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {90D0CDD5-EBEB-44AD-84CC-F731F27390E3}; ClientMachine = HV-CINDER-81722; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3780; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=598317770; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904690Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5522888hv-cinder-81722S-1-5-1811/9/2021 3:28:07 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {D668A730-D25E-4C61-BBD6-D41E51BB32A3}; ClientMachine = HV-CINDER-81722; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3780; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{26EFDA72-EA83-4A0B-B796-8892F6557334}"; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904689Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5522888hv-cinder-81722S-1-5-1811/9/2021 3:28:07 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {CA52E63B-0C66-498C-8ADB-EE83B105CA17}; ClientMachine = HV-CINDER-81722; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3780; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=958589380; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904688Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5524672hv-cinder-81722S-1-5-1811/9/2021 3:28:06 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {C1F44210-B325-4CB2-8C4C-CE6D4A3B9FA9}; ClientMachine = HV-CINDER-81722; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3780; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=199439123; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904687Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational552768hv-cinder-81722S-1-5-1811/9/2021 3:28:05 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {7D7F4EAB-8499-4FDE-998F-00236E72742D}; ClientMachine = HV-CINDER-81722; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3780; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1187398257; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904686Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5521824hv-cinder-81722S-1-5-1811/9/2021 3:28:03 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96268A47-93AB-460C-8C04-4883C8269C21}; ClientMachine = HV-CINDER-81722; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3780; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Host.HostName="iqn.2010-10.org.openstack:volume-a734480b-c885-4084-a33f-d08f7554a1bf"; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904685Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5524672hv-cinder-81722S-1-5-1811/9/2021 3:28:03 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {8DA73AD6-8897-4C48-AA55-51DD853F09C3}; ClientMachine = HV-CINDER-81722; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3780; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_IDMethod.HostName="iqn.2010-10.org.openstack:volume-a734480b-c885-4084-a33f-d08f7554a1bf",Method=4,Value="iqn.1991-05.com.microsoft:hv-cinder-81722"; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904684Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5522888hv-cinder-81722S-1-5-1811/9/2021 3:28:03 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {1B41DE39-C27C-42F8-924A-807CBB587C88}; ClientMachine = HV-CINDER-81722; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3780; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1726638700; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904683Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5522888hv-cinder-81722S-1-5-1811/9/2021 3:27:59 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {1774DFE1-D236-4BE7-846A-37843C2A0FD4}; ClientMachine = HV-CINDER-81722; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3780; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=987970977; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904682Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational552768hv-cinder-81722S-1-5-1811/9/2021 3:27:59 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {678E3C2C-8807-43A6-8777-D14C4AD98FF5}; ClientMachine = HV-CINDER-81722; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4480; Component = Unknown; Operation = Start IWbemServices::GetObject - root\virtualization\v2 : \\.\ROOT\virtualization\v2:Msvm_VirtualSystemSettingData.InstanceID="Microsoft:0E0938F0-19A5-49BF-9654-A9DAD7DE2031"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904681Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational552768hv-cinder-81722S-1-5-1811/9/2021 3:27:58 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {DC436607-4128-4659-A5B3-DED7608193FC}; ClientMachine = HV-CINDER-81722; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3780; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=566817898; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904680Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5524892hv-cinder-81722S-1-5-1811/9/2021 3:27:55 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {8DE0137A-8042-466A-8188-4AC81722E219}; ClientMachine = HV-CINDER-81722; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3780; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1799974880; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904679Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5524892hv-cinder-81722S-1-5-1811/9/2021 3:27:55 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {703B5641-94DA-4CE5-9A3E-3B081ED20F5E}; ClientMachine = HV-CINDER-81722; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3780; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{5321D261-CF45-4C2A-9421-4AE3EFE80D75}"; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904678Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5524672hv-cinder-81722S-1-5-1811/9/2021 3:27:54 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {E3035A33-4A06-4310-9092-AC2C9F9AAAFB}; ClientMachine = HV-CINDER-81722; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3780; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=246772617; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904677Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational552768hv-cinder-81722S-1-5-1811/9/2021 3:27:54 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {13818ED6-16DC-4383-9C55-52F3493AB1C7}; ClientMachine = HV-CINDER-81722; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3780; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{460FB9F8-A59D-40AD-A841-9DE783C7A4E0}"; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904676Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational552768hv-cinder-81722S-1-5-1811/9/2021 3:27:54 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {CA984CE7-2D7D-4F49-BDAD-B8004597BD6B}; ClientMachine = HV-CINDER-81722; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3780; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=541913327; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904675Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5524672hv-cinder-81722S-1-5-1811/9/2021 3:27:53 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {43EE2B20-5869-499A-97F0-C244E7BC3605}; ClientMachine = HV-CINDER-81722; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3780; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=2054354628; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904674Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5521824hv-cinder-81722S-1-5-1811/9/2021 3:27:53 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {23724AB3-37E8-409F-AFB4-32E3393EC685}; ClientMachine = HV-CINDER-81722; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3780; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{17EEF791-DB70-40E6-BBC3-2A475303D2C0}"; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904673Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5524924hv-cinder-81722S-1-5-1811/9/2021 3:27:53 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
StorageWMI provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4416; ProviderPath = %SystemRoot%\System32\storagewmi.dll585700004611686018427387904672Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational44161172hv-cinder-81722S-1-5-2011/9/2021 3:27:45 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {31522C5E-4861-49A4-9D5F-66BAC890AD80}; ClientMachine = HV-CINDER-81722; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3780; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=875341211; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904671Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5524896hv-cinder-81722S-1-5-1811/9/2021 3:27:36 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {825C6746-A960-4FBD-8429-6F25AD801C28}; ClientMachine = HV-CINDER-81722; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3780; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=94735369; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904670Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5522484hv-cinder-81722S-1-5-1811/9/2021 3:27:31 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {B3CC9D9D-539F-40D7-9E3A-9BB30560856A}; ClientMachine = HV-CINDER-81722; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3780; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1094603507; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904669Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational552768hv-cinder-81722S-1-5-1811/9/2021 3:27:10 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {B91A90F0-DE49-437A-85D7-408878BC7524}; ClientMachine = HV-CINDER-81722; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3780; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{35CA9412-1D23-47C1-A1FF-1EF1329F8D8F}"; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904668Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5521960hv-cinder-81722S-1-5-1811/9/2021 3:27:08 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {41206B3A-3CC1-4F76-AD2A-02515640E086}; ClientMachine = HV-CINDER-81722; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3780; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=317579142; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904667Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5521960hv-cinder-81722S-1-5-1811/9/2021 3:27:07 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {54478123-9F32-40E2-A4A2-3B14AA6AAB3B}; ClientMachine = HV-CINDER-81722; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3780; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=2146999556; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904666Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5521960hv-cinder-81722S-1-5-1811/9/2021 3:27:06 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9E80BBE4-F7E7-476A-84E8-8482E01863DA}; ClientMachine = HV-CINDER-81722; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3780; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{D1DCC890-E174-424D-9DF6-1184356F5594}"; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904665Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5521960hv-cinder-81722S-1-5-1811/9/2021 3:27:05 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32a provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4416; ProviderPath = %systemroot%\system32\wbem\wmipcima.dll585700004611686018427387904664Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational44164108hv-cinder-81722S-1-5-2011/9/2021 3:26:57 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
MSVSS__PROVIDER provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4416; ProviderPath = %systemroot%\system32\wbem\vsswmi.dll585700004611686018427387904663Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational44161172hv-cinder-81722S-1-5-2011/9/2021 3:26:57 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WinTargetProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1984; ProviderPath = C:\windows\system32\wbem\WTWMIProv.dll585700004611686018427387904662Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational19843764hv-cinder-81722S-1-5-1911/9/2021 3:26:57 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4416; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll585700004611686018427387904661Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational44161172hv-cinder-81722S-1-5-2011/9/2021 3:26:16 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 604; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll585700004611686018427387904660Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6044164hv-cinder-81722S-1-5-1811/9/2021 3:25:04 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4416; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll585700004611686018427387904659Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational44163316hv-cinder-81722S-1-5-2011/9/2021 3:25:04 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Namespace = root\virtualization\v2; NotificationQuery = SELECT * FROM __InstanceDeletionEvent WITHIN 2 WHERE TargetInstance ISA 'Msvm_SyntheticEthernetPortSettingData' ; UserName = NT AUTHORITY\SYSTEM; ClientProcessID = 5084, ClientMachine = HV-CINDER-81722; PossibleCause = Temporary586000004611686018427387904658Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5524952hv-cinder-81722S-1-5-1811/9/2021 3:24:36 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Namespace = root\virtualization\v2; NotificationQuery = SELECT * FROM __InstanceCreationEvent WITHIN 2 WHERE TargetInstance ISA 'Msvm_SyntheticEthernetPortSettingData' ; UserName = NT AUTHORITY\SYSTEM; ClientProcessID = 5084, ClientMachine = HV-CINDER-81722; PossibleCause = Temporary586000004611686018427387904657Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5524952hv-cinder-81722S-1-5-1811/9/2021 3:24:36 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Namespace = root\virtualization\v2; NotificationQuery = SELECT EnabledState, TargetInstance FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA 'Msvm_ComputerSystem' AND TargetInstance.EnabledState != PreviousInstance.EnabledState AND (TargetInstance.EnabledState = '2' OR TargetInstance.EnabledState = '3' OR TargetInstance.EnabledState = '32768' OR TargetInstance.EnabledState = '32769'); UserName = NT AUTHORITY\SYSTEM; ClientProcessID = 4480, ClientMachine = HV-CINDER-81722; PossibleCause = Temporary586000004611686018427387904656Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5524952hv-cinder-81722S-1-5-1811/9/2021 3:24:33 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WinTargetProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3236; ProviderPath = C:\windows\system32\wbem\WTWMIProv.dll585700004611686018427387904655Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational32365056hv-cinder-81722S-1-5-1911/9/2021 3:24:33 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WMIProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2156; ProviderPath = %systemroot%\system32\wbem\wmiprov.dll585700004611686018427387904654Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational21562796hv-cinder-81722S-1-5-1811/9/2021 3:24:32 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Win32_WIN32_TERMINALSERVICE_Prov provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4416; ProviderPath = %SystemRoot%\system32\tscfgwmi.dll585700004611686018427387904653Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational44163316hv-cinder-81722S-1-5-2011/9/2021 3:24:17 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 604; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll585700004611686018427387904652Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6044164hv-cinder-81722S-1-5-1811/9/2021 3:24:06 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4416; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll585700004611686018427387904651Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational44163316hv-cinder-81722S-1-5-2011/9/2021 3:24:06 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4416; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll585700004611686018427387904650Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational44163316hv-cinder-81722S-1-5-2011/9/2021 3:24:05 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WMIProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2164; ProviderPath = %systemroot%\system32\wbem\wmiprov.dll585700004611686018427387904649Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational21643252hv-cinder-81722S-1-5-1811/9/2021 3:07:44 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32a provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3924; ProviderPath = %systemroot%\system32\wbem\wmipcima.dll585700004611686018427387904648Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational39242568hv-cinder-81722S-1-5-2011/9/2021 3:06:43 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Win32_WIN32_TERMINALSERVICE_Prov provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3924; ProviderPath = %SystemRoot%\system32\tscfgwmi.dll585700004611686018427387904647Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational39243936hv-cinder-81722S-1-5-2011/9/2021 3:06:42 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3924; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll585700004611686018427387904646Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational39242568hv-cinder-81722S-1-5-2011/9/2021 3:06:42 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
MSIProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3528; ProviderPath = %systemroot%\system32\wbem\msiprov.dll585700004611686018427387904645Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational35283560hv-cinder-81722S-1-5-1811/9/2021 2:51:59 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {729E7326-D578-0002-8076-9E7278D5D701}; ClientMachine = HV-CINDER-81722; User = HV-CINDER-81722\Admin; ClientProcessId = 1452; Component = Core; Operation = Start IWbemServices::ExecNotificationQuery - root\virtualization\v2 : SELECT * FROM __InstanceDeletionEvent WITHIN 2 WHERE TargetInstance ISA 'Msvm_ConcreteJob'; ResultCode = 0x800706BE; PossibleCause = Could not send status to client585802004611686018427387904644Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5523840hv-cinder-81722S-1-5-1811/9/2021 2:48:03 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {729E7326-D578-0002-8076-9E7278D5D701}; ClientMachine = HV-CINDER-81722; User = HV-CINDER-81722\Admin; ClientProcessId = 1452; Component = Unknown; Operation = Start IWbemServices::ExecNotificationQuery - root\virtualization\v2 : SELECT * FROM __InstanceDeletionEvent WITHIN 2 WHERE TargetInstance ISA 'Msvm_ConcreteJob'; ResultCode = 0x80041032; PossibleCause = Unknown585802004611686018427387904643Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5522432hv-cinder-81722S-1-5-1811/9/2021 2:48:03 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {729E7326-D578-0002-8076-9E7278D5D701}; ClientMachine = HV-CINDER-81722; User = HV-CINDER-81722\Admin; ClientProcessId = 1452; Component = Unknown; Operation = Start IWbemServices::ExecNotificationQuery - root\virtualization\v2 : SELECT * FROM __InstanceModificationEvent WITHIN 2 WHERE TargetInstance ISA 'Msvm_ConcreteJob'; ResultCode = 0x80041032; PossibleCause = Unknown585802004611686018427387904642Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5522432hv-cinder-81722S-1-5-1811/9/2021 2:48:01 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Namespace = root\virtualization\v2; NotificationQuery = SELECT * FROM __InstanceDeletionEvent WITHIN 2 WHERE TargetInstance ISA 'Msvm_ConcreteJob'; UserName = HV-CINDER-81722\Admin; ClientProcessID = 1452, ClientMachine = HV-CINDER-81722; PossibleCause = Temporary586000004611686018427387904641Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5522432hv-cinder-81722S-1-5-1811/9/2021 2:48:01 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Namespace = root\virtualization\v2; NotificationQuery = SELECT * FROM __InstanceModificationEvent WITHIN 2 WHERE TargetInstance ISA 'Msvm_ConcreteJob'; UserName = HV-CINDER-81722\Admin; ClientProcessID = 1452, ClientMachine = HV-CINDER-81722; PossibleCause = Temporary586000004611686018427387904640Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5522432hv-cinder-81722S-1-5-1811/9/2021 2:48:01 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NetAdapterCim provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1400; ProviderPath = %systemroot%\system32\wbem\NetAdapterCim.dll585700004611686018427387904639Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational14003372hv-cinder-81722S-1-5-1911/9/2021 2:48:01 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
nettcpip provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2380; ProviderPath = %systemroot%\system32\wbem\NetTCPIP.dll585700004611686018427387904638Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational23802452hv-cinder-81722S-1-5-2011/9/2021 2:47:59 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
MSiSCSITargetProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 920; ProviderPath = C:\windows\system32\wbem\SmIscsiTargetProv.dll585700004611686018427387904637Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational920872hv-cinder-81722S-1-5-2011/9/2021 2:47:57 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WinTargetProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4004; ProviderPath = C:\windows\system32\wbem\WTWMIProv.dll585700004611686018427387904636Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational40043212hv-cinder-81722S-1-5-1911/9/2021 2:47:57 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WMIProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3528; ProviderPath = %systemroot%\system32\wbem\wmiprov.dll585700004611686018427387904635Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational35283560hv-cinder-81722S-1-5-1811/9/2021 2:47:57 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
MSiSCSITargetProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 920; ProviderPath = C:\windows\system32\wbem\SmIscsiTargetProv.dll585700004611686018427387904634Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational920968hv-cinder-81722S-1-5-2011/9/2021 2:47:57 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Win32_WIN32_TERMINALSERVICE_Prov provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2380; ProviderPath = %SystemRoot%\system32\tscfgwmi.dll585700004611686018427387904633Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational23802452hv-cinder-81722S-1-5-2011/9/2021 2:47:45 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
wfascim provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2380; ProviderPath = %systemroot%\system32\wbem\wfascim.dll585700004611686018427387904632Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational23803876hv-cinder-81722S-1-5-2011/9/2021 2:47:42 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 668; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll585700004611686018427387904631Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6683160hv-cinder-81722S-1-5-1811/9/2021 2:47:10 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2380; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll585700004611686018427387904630Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational23802452hv-cinder-81722S-1-5-2011/9/2021 2:47:10 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = HV-CINDER-81722; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3944; Component = Unknown; Operation = Start IWbemServices::CreateInstanceEnum - root\wmi : MSiSCSI_PortalInfoClass; ResultCode = 0x8004100C; PossibleCause = Unknown585802004611686018427387904629Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational552804hv-cinder-81722S-1-5-1811/9/2021 2:46:41 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = HV-CINDER-81722; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3944; Component = Unknown; Operation = Start IWbemServices::CreateInstanceEnum - root\wmi : MS_SM_AdapterInformationQuery; ResultCode = 0x8004100C; PossibleCause = Unknown585802004611686018427387904628Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational552804hv-cinder-81722S-1-5-1811/9/2021 2:46:41 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
wmiprov provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3528; ProviderPath = %systemroot%\system32\wbem\wmiprov.dll585700004611686018427387904627Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational35283560hv-cinder-81722S-1-5-1811/9/2021 2:46:41 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = HV-CINDER-81722; User = HV-CINDER-81722\cloudbase-init; ClientProcessId = 3216; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\cimv2 : SELECT RemainingWindowsReArmCount, KeyManagementServiceListeningPort, KeyManagementServiceDnsPublishing, KeyManagementServiceLowPriority, ClientMachineId, KeyManagementServiceHostCaching, Version FROM SoftwareLicensingService; ResultCode = 0x80041032; PossibleCause = Unknown585802004611686018427387904626Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5522992hv-cinder-81722S-1-5-1811/9/2021 2:46:38 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
SppProvider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2380; ProviderPath = %SystemRoot%\System32\sppwmi.dll585700004611686018427387904625Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational23802452hv-cinder-81722S-1-5-2011/9/2021 2:46:37 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = HV-CINDER-81722; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3140; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\Microsoft\Windows\DeviceGuard : SELECT AvailableSecurityProperties FROM Win32_DeviceGuard ; ResultCode = 0x80041032; PossibleCause = Unknown585802004611686018427387904624Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational552540hv-cinder-81722S-1-5-1811/9/2021 2:46:21 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = HV-CINDER-81722; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3140; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\Microsoft\Windows\DeviceGuard : SELECT RequiredSecurityProperties FROM Win32_DeviceGuard ; ResultCode = 0x80041032; PossibleCause = Unknown585802004611686018427387904623Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational552540hv-cinder-81722S-1-5-1811/9/2021 2:46:21 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = HV-CINDER-81722; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3140; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\Microsoft\Windows\DeviceGuard : SELECT SecurityServicesConfigured FROM Win32_DeviceGuard ; ResultCode = 0x80041032; PossibleCause = Unknown585802004611686018427387904622Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5522992hv-cinder-81722S-1-5-1811/9/2021 2:46:21 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Win32_TpmProvider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2380; ProviderPath = C:\Windows\system32\wbem\Win32_TPM.dll585700004611686018427387904621Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational23802708hv-cinder-81722S-1-5-2011/9/2021 2:46:21 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = HV-CINDER-81722; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3140; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\Microsoft\Windows\DeviceGuard : SELECT VirtualizationBasedSecurityStatus FROM Win32_DeviceGuard ; ResultCode = 0x80041032; PossibleCause = Unknown585802004611686018427387904620Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5522484hv-cinder-81722S-1-5-1811/9/2021 2:46:21 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = HV-CINDER-81722; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3140; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\Microsoft\Windows\DeviceGuard : SELECT SecurityServicesRunning FROM Win32_DeviceGuard ; ResultCode = 0x80041032; PossibleCause = Unknown585802004611686018427387904619Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational552540hv-cinder-81722S-1-5-1811/9/2021 2:46:21 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = HV-CINDER-81722; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3140; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\Microsoft\Windows\DeviceGuard : SELECT SecurityServicesRunning FROM Win32_DeviceGuard ; ResultCode = 0x80041032; PossibleCause = Unknown585802004611686018427387904618Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5522992hv-cinder-81722S-1-5-1811/9/2021 2:46:21 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = HV-CINDER-81722; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3140; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\Microsoft\Windows\DeviceGuard : SELECT AvailableSecurityProperties FROM Win32_DeviceGuard ; ResultCode = 0x80041032; PossibleCause = Unknown585802004611686018427387904617Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5522992hv-cinder-81722S-1-5-1811/9/2021 2:46:21 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = HV-CINDER-81722; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3140; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\Microsoft\Windows\DeviceGuard : SELECT RequiredSecurityProperties FROM Win32_DeviceGuard ; ResultCode = 0x80041032; PossibleCause = Unknown585802004611686018427387904616Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5522992hv-cinder-81722S-1-5-1811/9/2021 2:46:21 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = HV-CINDER-81722; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3140; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\Microsoft\Windows\DeviceGuard : SELECT VirtualizationBasedSecurityStatus FROM Win32_DeviceGuard ; ResultCode = 0x80041032; PossibleCause = Unknown585802004611686018427387904615Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5522484hv-cinder-81722S-1-5-1811/9/2021 2:46:21 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Win32_DeviceGuard provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2380; ProviderPath = %SystemRoot%\System32\Win32_DeviceGuard.dll585700004611686018427387904614Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational23802708hv-cinder-81722S-1-5-2011/9/2021 2:46:21 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = HV-CINDER-81722; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3140; Component = Unknown; Operation = Start IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT ID FROM Win32_ServerFeature; ResultCode = 0x80041032; PossibleCause = Unknown585802004611686018427387904613Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5522992hv-cinder-81722S-1-5-1811/9/2021 2:46:19 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 668; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll585700004611686018427387904612Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6683692hv-cinder-81722S-1-5-1811/9/2021 2:46:14 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
ServerFeatureProvider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2380; ProviderPath = %windir%\system32\wbem\servercompprov.dll585700004611686018427387904611Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational23802452hv-cinder-81722S-1-5-2011/9/2021 2:46:14 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {6C1EDA1C-888E-49ED-9D6C-759D25E61176}; ClientMachine = HV-CINDER-81722; User = ; ClientProcessId = 552; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{FC491EF1-C4AA-4CE1-B329-414B101DB823}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904610Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5522352hv-cinder-81722S-1-5-1811/9/2021 2:46:05 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {6C1EDA1C-888E-49ED-9D6C-759D25E61176}; ClientMachine = HV-CINDER-81722; User = ; ClientProcessId = 552; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{fbf687e6-f063-4d9f-9f4f-fd9a26acdd5f}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904609Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5522352hv-cinder-81722S-1-5-1811/9/2021 2:46:05 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {6C1EDA1C-888E-49ED-9D6C-759D25E61176}; ClientMachine = HV-CINDER-81722; User = ; ClientProcessId = 552; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{FB2CA36D-0B40-4307-821B-A13B252DE56C}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904608Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5522352hv-cinder-81722S-1-5-1811/9/2021 2:46:05 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {6C1EDA1C-888E-49ED-9D6C-759D25E61176}; ClientMachine = HV-CINDER-81722; User = ; ClientProcessId = 552; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{f3ccc681-b74c-4060-9f26-cd84525dca2a}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904607Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5522352hv-cinder-81722S-1-5-1811/9/2021 2:46:05 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {6C1EDA1C-888E-49ED-9D6C-759D25E61176}; ClientMachine = HV-CINDER-81722; User = ; ClientProcessId = 552; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{F312195E-3D9D-447A-A3F5-08DFFA24735E}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904606Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5522352hv-cinder-81722S-1-5-1811/9/2021 2:46:05 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {6C1EDA1C-888E-49ED-9D6C-759D25E61176}; ClientMachine = HV-CINDER-81722; User = ; ClientProcessId = 552; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{E62688F0-25FD-4c90-BFF5-F508B9D2E31F}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904605Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5522352hv-cinder-81722S-1-5-1811/9/2021 2:46:05 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {6C1EDA1C-888E-49ED-9D6C-759D25E61176}; ClientMachine = HV-CINDER-81722; User = ; ClientProcessId = 552; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{E5094040-C46C-4115-B030-04FB2E545B00}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904604Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5522352hv-cinder-81722S-1-5-1811/9/2021 2:46:05 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {6C1EDA1C-888E-49ED-9D6C-759D25E61176}; ClientMachine = HV-CINDER-81722; User = ; ClientProcessId = 552; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{E4F48E54-F38D-4884-BFB9-D4D2E5729C18}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904603Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5522352hv-cinder-81722S-1-5-1811/9/2021 2:46:05 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {6C1EDA1C-888E-49ED-9D6C-759D25E61176}; ClientMachine = HV-CINDER-81722; User = ; ClientProcessId = 552; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{e437bc1c-aa7d-11d2-a382-00c04f991e27}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904602Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5522352hv-cinder-81722S-1-5-1811/9/2021 2:46:05 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {6C1EDA1C-888E-49ED-9D6C-759D25E61176}; ClientMachine = HV-CINDER-81722; User = ; ClientProcessId = 552; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{CF7639F3-ABA2-41DB-97F2-81E2C5DBFC5D}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904601Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5522352hv-cinder-81722S-1-5-1811/9/2021 2:46:05 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {6C1EDA1C-888E-49ED-9D6C-759D25E61176}; ClientMachine = HV-CINDER-81722; User = ; ClientProcessId = 552; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{cdeafc3d-948d-49dd-ab12-e578ba4af7aa}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904600Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5522352hv-cinder-81722S-1-5-1811/9/2021 2:46:05 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {6C1EDA1C-888E-49ED-9D6C-759D25E61176}; ClientMachine = HV-CINDER-81722; User = ; ClientProcessId = 552; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{c6dc5466-785a-11d2-84d0-00c04fb169f7}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904599Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5522352hv-cinder-81722S-1-5-1811/9/2021 2:46:05 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {6C1EDA1C-888E-49ED-9D6C-759D25E61176}; ClientMachine = HV-CINDER-81722; User = ; ClientProcessId = 552; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{C631DF4C-088F-4156-B058-4375F0853CD8}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904598Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5522352hv-cinder-81722S-1-5-1811/9/2021 2:46:05 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {6C1EDA1C-888E-49ED-9D6C-759D25E61176}; ClientMachine = HV-CINDER-81722; User = ; ClientProcessId = 552; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{C418DD9D-0D14-4efb-8FBF-CFE535C8FAC7}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904597Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5522352hv-cinder-81722S-1-5-1811/9/2021 2:46:05 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {6C1EDA1C-888E-49ED-9D6C-759D25E61176}; ClientMachine = HV-CINDER-81722; User = ; ClientProcessId = 552; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{C34B2751-1CF4-44F5-9262-C3FC39666591}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904596Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5522352hv-cinder-81722S-1-5-1811/9/2021 2:46:05 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {6C1EDA1C-888E-49ED-9D6C-759D25E61176}; ClientMachine = HV-CINDER-81722; User = ; ClientProcessId = 552; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{BC75B1ED-5833-4858-9BB8-CBF0B166DF9D}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904595Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5522352hv-cinder-81722S-1-5-1811/9/2021 2:46:05 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {6C1EDA1C-888E-49ED-9D6C-759D25E61176}; ClientMachine = HV-CINDER-81722; User = ; ClientProcessId = 552; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{BA649533-0AAC-4E04-B9BC-4DBAE0325B12}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904594Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5522352hv-cinder-81722S-1-5-1811/9/2021 2:46:05 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {6C1EDA1C-888E-49ED-9D6C-759D25E61176}; ClientMachine = HV-CINDER-81722; User = ; ClientProcessId = 552; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{B587E2B1-4D59-4e7e-AED9-22B9DF11D053}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904593Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5522352hv-cinder-81722S-1-5-1811/9/2021 2:46:05 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {6C1EDA1C-888E-49ED-9D6C-759D25E61176}; ClientMachine = HV-CINDER-81722; User = ; ClientProcessId = 552; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{B087BE9D-ED37-454f-AF9C-04291E351182}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904592Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5522352hv-cinder-81722S-1-5-1811/9/2021 2:46:05 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {6C1EDA1C-888E-49ED-9D6C-759D25E61176}; ClientMachine = HV-CINDER-81722; User = ; ClientProcessId = 552; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{AADCED64-746C-4633-A97C-D61349046527}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904591Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5522352hv-cinder-81722S-1-5-1811/9/2021 2:46:05 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {6C1EDA1C-888E-49ED-9D6C-759D25E61176}; ClientMachine = HV-CINDER-81722; User = ; ClientProcessId = 552; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{A3F3E39B-5D83-4940-B954-28315B82F0A8}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904590Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5522352hv-cinder-81722S-1-5-1811/9/2021 2:46:05 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {6C1EDA1C-888E-49ED-9D6C-759D25E61176}; ClientMachine = HV-CINDER-81722; User = ; ClientProcessId = 552; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{91FBB303-0CD5-4055-BF42-E512A681B325}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904589Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5522352hv-cinder-81722S-1-5-1811/9/2021 2:46:05 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {6C1EDA1C-888E-49ED-9D6C-759D25E61176}; ClientMachine = HV-CINDER-81722; User = ; ClientProcessId = 552; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{8A28E2C5-8D06-49A4-A08C-632DAA493E17}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904588Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5522352hv-cinder-81722S-1-5-1811/9/2021 2:46:05 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {6C1EDA1C-888E-49ED-9D6C-759D25E61176}; ClientMachine = HV-CINDER-81722; User = ; ClientProcessId = 552; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{827D319E-6EAC-11D2-A4EA-00C04F79F83A}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904587Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5522352hv-cinder-81722S-1-5-1811/9/2021 2:46:05 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {6C1EDA1C-888E-49ED-9D6C-759D25E61176}; ClientMachine = HV-CINDER-81722; User = ; ClientProcessId = 552; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{7B849a69-220F-451E-B3FE-2CB811AF94AE}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904586Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5522352hv-cinder-81722S-1-5-1811/9/2021 2:46:05 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {6C1EDA1C-888E-49ED-9D6C-759D25E61176}; ClientMachine = HV-CINDER-81722; User = ; ClientProcessId = 552; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{7933F41E-56F8-41d6-A31C-4148A711EE93}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904585Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5522352hv-cinder-81722S-1-5-1811/9/2021 2:46:05 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {6C1EDA1C-888E-49ED-9D6C-759D25E61176}; ClientMachine = HV-CINDER-81722; User = ; ClientProcessId = 552; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{74EE6C03-5363-4554-B161-627540339CAB}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904584Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5522352hv-cinder-81722S-1-5-1811/9/2021 2:46:05 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {6C1EDA1C-888E-49ED-9D6C-759D25E61176}; ClientMachine = HV-CINDER-81722; User = ; ClientProcessId = 552; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{728EE579-943C-4519-9EF7-AB56765798ED}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904583Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5522352hv-cinder-81722S-1-5-1811/9/2021 2:46:05 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {6C1EDA1C-888E-49ED-9D6C-759D25E61176}; ClientMachine = HV-CINDER-81722; User = ; ClientProcessId = 552; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{7150F9BF-48AD-4da4-A49C-29EF4A8369BA}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904582Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5522352hv-cinder-81722S-1-5-1811/9/2021 2:46:05 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {6C1EDA1C-888E-49ED-9D6C-759D25E61176}; ClientMachine = HV-CINDER-81722; User = ; ClientProcessId = 552; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{6A4C88C6-C502-4f74-8F60-2CB23EDC24E2}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904581Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5522352hv-cinder-81722S-1-5-1811/9/2021 2:46:05 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {6C1EDA1C-888E-49ED-9D6C-759D25E61176}; ClientMachine = HV-CINDER-81722; User = ; ClientProcessId = 552; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{6232C319-91AC-4931-9385-E70C2B099F0E}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904580Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5522352hv-cinder-81722S-1-5-1811/9/2021 2:46:05 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {6C1EDA1C-888E-49ED-9D6C-759D25E61176}; ClientMachine = HV-CINDER-81722; User = ; ClientProcessId = 552; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{4CFB60C1-FAA6-47f1-89AA-0B18730C9FD3}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904579Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5522352hv-cinder-81722S-1-5-1811/9/2021 2:46:05 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {6C1EDA1C-888E-49ED-9D6C-759D25E61176}; ClientMachine = HV-CINDER-81722; User = ; ClientProcessId = 552; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{4bcd6cde-777b-48b6-9804-43568e23545d}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904578Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5522352hv-cinder-81722S-1-5-1811/9/2021 2:46:05 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {6C1EDA1C-888E-49ED-9D6C-759D25E61176}; ClientMachine = HV-CINDER-81722; User = ; ClientProcessId = 552; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{4B7C3B0F-E993-4E06-A241-3FBE06943684}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904577Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5522352hv-cinder-81722S-1-5-1811/9/2021 2:46:05 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {6C1EDA1C-888E-49ED-9D6C-759D25E61176}; ClientMachine = HV-CINDER-81722; User = ; ClientProcessId = 552; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{42B5FAAE-6536-11d2-AE5A-0000F87571E3}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904576Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5522352hv-cinder-81722S-1-5-1811/9/2021 2:46:05 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {6C1EDA1C-888E-49ED-9D6C-759D25E61176}; ClientMachine = HV-CINDER-81722; User = ; ClientProcessId = 552; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{426031c0-0b47-4852-b0ca-ac3d37bfcb39}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904575Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5522352hv-cinder-81722S-1-5-1811/9/2021 2:46:05 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {6C1EDA1C-888E-49ED-9D6C-759D25E61176}; ClientMachine = HV-CINDER-81722; User = ; ClientProcessId = 552; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{3A0DBA37-F8B2-4356-83DE-3E90BD5C261F}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904574Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5522352hv-cinder-81722S-1-5-1811/9/2021 2:46:05 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {6C1EDA1C-888E-49ED-9D6C-759D25E61176}; ClientMachine = HV-CINDER-81722; User = ; ClientProcessId = 552; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{3610eda5-77ef-11d2-8dc5-00c04fa31a66}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904573Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5522352hv-cinder-81722S-1-5-1811/9/2021 2:46:05 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {6C1EDA1C-888E-49ED-9D6C-759D25E61176}; ClientMachine = HV-CINDER-81722; User = ; ClientProcessId = 552; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{2BFCC077-22D2-48DE-BDE1-2F618D9B476D}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904572Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5522352hv-cinder-81722S-1-5-1811/9/2021 2:46:05 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {6C1EDA1C-888E-49ED-9D6C-759D25E61176}; ClientMachine = HV-CINDER-81722; User = ; ClientProcessId = 552; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{2A8FDC61-2347-4C87-92F6-B05EB91A201A}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904571Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5522352hv-cinder-81722S-1-5-1811/9/2021 2:46:05 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {6C1EDA1C-888E-49ED-9D6C-759D25E61176}; ClientMachine = HV-CINDER-81722; User = ; ClientProcessId = 552; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{1A6364EB-776B-4120-ADE1-B63A406A76B5}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904570Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5522352hv-cinder-81722S-1-5-1811/9/2021 2:46:05 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {6C1EDA1C-888E-49ED-9D6C-759D25E61176}; ClientMachine = HV-CINDER-81722; User = ; ClientProcessId = 552; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{17D89FEC-5C44-4972-B12D-241CAEF74509}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904569Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5522352hv-cinder-81722S-1-5-1811/9/2021 2:46:05 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {6C1EDA1C-888E-49ED-9D6C-759D25E61176}; ClientMachine = HV-CINDER-81722; User = ; ClientProcessId = 552; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{16be69fa-4209-4250-88cb-716cf41954e0}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904568Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5522352hv-cinder-81722S-1-5-1811/9/2021 2:46:05 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {6C1EDA1C-888E-49ED-9D6C-759D25E61176}; ClientMachine = HV-CINDER-81722; User = ; ClientProcessId = 552; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{169EBF44-942F-4C43-87CE-13C93996EBBE}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904567Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5522352hv-cinder-81722S-1-5-1811/9/2021 2:46:05 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {6C1EDA1C-888E-49ED-9D6C-759D25E61176}; ClientMachine = HV-CINDER-81722; User = ; ClientProcessId = 552; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{0E28E245-9368-4853-AD84-6DA3BA35BB75}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904566Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5522352hv-cinder-81722S-1-5-1811/9/2021 2:46:05 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {6C1EDA1C-888E-49ED-9D6C-759D25E61176}; ClientMachine = HV-CINDER-81722; User = ; ClientProcessId = 552; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{0ACDD40C-75AC-47ab-BAA0-BF6DE7E7FE63}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904565Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5522352hv-cinder-81722S-1-5-1811/9/2021 2:46:05 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Namespace = //./root/CIMV2; NotificationQuery = select * from MSFT_SCMEventLogEvent; OwnerName = S-1-5-32-544; HostProcessID = 552; Provider= SCM Event Provider, queryID = 0; PossibleCause = Permanent585900004611686018427387904564Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5521304hv-cinder-81722S-1-5-1811/9/2021 2:46:03 PM729e7326-d578-0002-b373-9e7278d5d701microsoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Namespace = root\virtualization\v2; NotificationQuery = SELECT * FROM __ClassOperationEvent; UserName = .\SYSTEM; ClientProcessID = 0, ClientMachine = ; PossibleCause = Temporary586000004611686018427387904563Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5522352hv-cinder-81722S-1-5-1811/9/2021 2:46:02 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Namespace = //./root/subscription; Eventfilter = SCM Event Log Filter (refer to its activate eventid:5859); Consumer = NTEventLogEventConsumer="SCM Event Log Consumer"; PossibleCause = Binding EventFilter: instance of __EventFilter { CreatorSID = {1, 2, 0, 0, 0, 0, 0, 5, 32, 0, 0, 0, 32, 2, 0, 0}; EventNamespace = "root\\cimv2"; Name = "SCM Event Log Filter"; Query = "select * from MSFT_SCMEventLogEvent"; QueryLanguage = "WQL"; }; Perm. Consumer: instance of NTEventLogEventConsumer { Category = 0; CreatorSID = {1, 2, 0, 0, 0, 0, 0, 5, 32, 0, 0, 0, 32, 2, 0, 0}; EventType = 1; Name = "SCM Event Log Consumer"; NameOfUserSIDProperty = "sid"; SourceName = "Service Control Manager"; }; 586100004611686018427387904562Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5521308hv-cinder-81722S-1-5-1811/9/2021 2:46:02 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32a provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2380; ProviderPath = %systemroot%\system32\wbem\wmipcima.dll585700004611686018427387904561Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational23802452hv-cinder-81722S-1-5-2011/9/2021 2:46:02 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WMIProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3528; ProviderPath = %systemroot%\system32\wbem\wmiprov.dll585700004611686018427387904560Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational35283560hv-cinder-81722S-1-5-1811/9/2021 2:46:01 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WMIProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3528; ProviderPath = %systemroot%\system32\wbem\wmiprov.dll585700004611686018427387904559Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational35283560hv-cinder-81722S-1-5-1811/9/2021 2:46:01 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = HV-CINDER-81722; User = NT AUTHORITY\SYSTEM; ClientProcessId = 2924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User : __Namespace.name="S_1_5_21_2052001392_3343622508_3304888568_500"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904558Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5522352hv-cinder-81722S-1-5-1811/9/2021 2:45:57 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = HV-CINDER-81722; User = NT AUTHORITY\SYSTEM; ClientProcessId = 2508; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\virtualization\v2 : Msvm_ResourcePoolComponent.Name="Microsoft|RDV Integration Component Resource Pool|V2.0"; ResultCode = 0x80041010; PossibleCause = Unknown585802004611686018427387904557Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5522352hv-cinder-81722S-1-5-1811/9/2021 2:45:56 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2380; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll585700004611686018427387904556Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational23802456hv-cinder-81722S-1-5-2011/9/2021 2:45:55 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-AKM2NNODP79; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3020; Component = Unknown; Operation = Start IWbemServices::CreateInstanceEnum - root\wmi : MSiSCSI_PortalInfoClass; ResultCode = 0x8004100A; PossibleCause = Unknown585802004611686018427387904555Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5281248WIN-5T344G8GM1HS-1-5-1811/9/2021 2:45:23 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-AKM2NNODP79; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3020; Component = Unknown; Operation = Start IWbemServices::CreateInstanceEnum - root\wmi : MS_SM_AdapterInformationQuery; ResultCode = 0x8004100A; PossibleCause = Unknown585802004611686018427387904554Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5281248WIN-5T344G8GM1HS-1-5-1811/9/2021 2:45:23 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-AKM2NNODP79; User = NT AUTHORITY\SYSTEM; ClientProcessId = 2120; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\virtualization\v2 : Msvm_ResourcePoolComponent.Name="Microsoft|RDV Integration Component Resource Pool|V2.0"; ResultCode = 0x80041010; PossibleCause = Unknown585802004611686018427387904553Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5282380WIN-5T344G8GM1HS-1-5-1811/9/2021 2:44:28 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-AKM2NNODP79; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1744; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\cimv2 : select * from Win32_OperatingSystem; ResultCode = 0x8004100A; PossibleCause = Unknown585802004611686018427387904552Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5282380WIN-5T344G8GM1HS-1-5-1811/9/2021 2:44:28 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4848; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\wmi : select * from WDMClassesOfDriver where ClassName = "RNDISMPStatisticsOID"; ResultCode = 0x80041032; PossibleCause = Unknown585802004611686018427387904551Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9763432WIN-5T344G8GM1HS-1-5-181/19/2018 9:48:09 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4848; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\wmi : select * from WMIBinaryMofResource where Name = "C:\\windows\\System32\\drivers\\en-US\\netvsc.sys.mui[NdisMofResource]"; ResultCode = 0x80041032; PossibleCause = Unknown585802004611686018427387904550Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9763432WIN-5T344G8GM1HS-1-5-181/19/2018 9:48:09 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
MSVDS__PROVIDER provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4460; ProviderPath = %systemroot%\system32\wbem\vdswmi.dll585700004611686018427387904549Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational44605048WIN-5T344G8GM1HS-1-5-201/19/2018 9:46:31 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4460; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll585700004611686018427387904548Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational44605048WIN-5T344G8GM1HS-1-5-201/19/2018 9:46:31 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WMIProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4848; ProviderPath = %systemroot%\system32\wbem\wmiprov.dll585700004611686018427387904547Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational48484776WIN-5T344G8GM1HS-1-5-181/19/2018 9:45:30 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = WIN-5T344G8GM1H\Administrator; ClientProcessId = 4956; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\Microsoft\Windows\Defender : SELECT * FROM MSFT_MpComputerStatus; ResultCode = 0x80041032; PossibleCause = Unknown585802004611686018427387904546Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9761176WIN-5T344G8GM1HS-1-5-181/19/2018 9:42:52 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
ProtectionManagement provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3752; ProviderPath = "%ProgramData%\Microsoft\Windows Defender\Platform\4.12.17007.18011-0\ProtectionManagement.dll"585700004611686018427387904545Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational37522228WIN-5T344G8GM1HS-1-5-191/19/2018 9:42:52 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
MsNetImPlatform provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2776; ProviderPath = %systemroot%\system32\wbem\ndisimplatcim.dll585700004611686018427387904544Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational27763064WIN-5T344G8GM1HS-1-5-201/19/2018 9:42:52 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4120; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll585700004611686018427387904543Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational41204148WIN-5T344G8GM1HS-1-5-181/19/2018 9:42:50 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
nettcpip provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2776; ProviderPath = %systemroot%\system32\wbem\NetTCPIP.dll585700004611686018427387904542Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational27761292WIN-5T344G8GM1HS-1-5-201/19/2018 9:42:48 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NetAdapterCim provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3752; ProviderPath = %systemroot%\system32\wbem\NetAdapterCim.dll585700004611686018427387904541Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational37522228WIN-5T344G8GM1HS-1-5-191/19/2018 9:42:48 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2776; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll585700004611686018427387904540Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational27763064WIN-5T344G8GM1HS-1-5-201/19/2018 9:42:48 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
MSVDS__PROVIDER provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2776; ProviderPath = %systemroot%\system32\wbem\vdswmi.dll585700004611686018427387904539Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational27763064WIN-5T344G8GM1HS-1-5-201/19/2018 9:42:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32a provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2776; ProviderPath = %systemroot%\system32\wbem\wmipcima.dll585700004611686018427387904538Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational27763064WIN-5T344G8GM1HS-1-5-201/19/2018 9:42:16 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4120; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll585700004611686018427387904537Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational41204148WIN-5T344G8GM1HS-1-5-181/19/2018 9:41:43 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
nettcpip provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2776; ProviderPath = %systemroot%\system32\wbem\NetTCPIP.dll585700004611686018427387904536Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational27761292WIN-5T344G8GM1HS-1-5-201/19/2018 9:41:39 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NetAdapterCim provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3752; ProviderPath = %systemroot%\system32\wbem\NetAdapterCim.dll585700004611686018427387904535Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational37522228WIN-5T344G8GM1HS-1-5-191/19/2018 9:41:39 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2776; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll585700004611686018427387904534Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational27762812WIN-5T344G8GM1HS-1-5-201/19/2018 9:41:39 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Namespace = //./root/CIMV2; NotificationQuery = select * from MSFT_SCMEventLogEvent; OwnerName = S-1-5-32-544; HostProcessID = 976; Provider= SCM Event Provider, queryID = 0; PossibleCause = Permanent585900004611686018427387904533Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9762172WIN-5T344G8GM1HS-1-5-181/19/2018 9:41:32 AMad8d0f9c-9109-0001-0a10-8dad0991d301microsoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Namespace = root\virtualization\v2; NotificationQuery = SELECT * FROM __ClassOperationEvent; UserName = .\SYSTEM; ClientProcessID = 0, ClientMachine = ; PossibleCause = Temporary586000004611686018427387904532Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9762680WIN-5T344G8GM1HS-1-5-181/19/2018 9:41:32 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Namespace = //./root/subscription; Eventfilter = SCM Event Log Filter (refer to its activate eventid:5859); Consumer = NTEventLogEventConsumer="SCM Event Log Consumer"; PossibleCause = Binding EventFilter: instance of __EventFilter { CreatorSID = {1, 2, 0, 0, 0, 0, 0, 5, 32, 0, 0, 0, 32, 2, 0, 0}; EventNamespace = "root\\cimv2"; Name = "SCM Event Log Filter"; Query = "select * from MSFT_SCMEventLogEvent"; QueryLanguage = "WQL"; }; Perm. Consumer: instance of NTEventLogEventConsumer { Category = 0; CreatorSID = {1, 2, 0, 0, 0, 0, 0, 5, 32, 0, 0, 0, 32, 2, 0, 0}; EventType = 1; Name = "SCM Event Log Consumer"; NameOfUserSIDProperty = "sid"; SourceName = "Service Control Manager"; }; 586100004611686018427387904531Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational976388WIN-5T344G8GM1HS-1-5-181/19/2018 9:41:32 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{FC491EF1-C4AA-4CE1-B329-414B101DB823}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904530Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9762680WIN-5T344G8GM1HS-1-5-181/19/2018 9:41:32 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{fbf687e6-f063-4d9f-9f4f-fd9a26acdd5f}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904529Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9762680WIN-5T344G8GM1HS-1-5-181/19/2018 9:41:32 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{FB2CA36D-0B40-4307-821B-A13B252DE56C}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904528Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9762680WIN-5T344G8GM1HS-1-5-181/19/2018 9:41:32 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{f3ccc681-b74c-4060-9f26-cd84525dca2a}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904527Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9762680WIN-5T344G8GM1HS-1-5-181/19/2018 9:41:32 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{F312195E-3D9D-447A-A3F5-08DFFA24735E}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904526Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9762680WIN-5T344G8GM1HS-1-5-181/19/2018 9:41:32 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{E62688F0-25FD-4c90-BFF5-F508B9D2E31F}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904525Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9762680WIN-5T344G8GM1HS-1-5-181/19/2018 9:41:32 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{E5094040-C46C-4115-B030-04FB2E545B00}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904524Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9762680WIN-5T344G8GM1HS-1-5-181/19/2018 9:41:32 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{E4F48E54-F38D-4884-BFB9-D4D2E5729C18}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904523Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9762680WIN-5T344G8GM1HS-1-5-181/19/2018 9:41:32 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{e437bc1c-aa7d-11d2-a382-00c04f991e27}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904522Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9762680WIN-5T344G8GM1HS-1-5-181/19/2018 9:41:32 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{CF7639F3-ABA2-41DB-97F2-81E2C5DBFC5D}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904521Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9762680WIN-5T344G8GM1HS-1-5-181/19/2018 9:41:32 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{cdeafc3d-948d-49dd-ab12-e578ba4af7aa}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904520Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9762680WIN-5T344G8GM1HS-1-5-181/19/2018 9:41:32 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{c6dc5466-785a-11d2-84d0-00c04fb169f7}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904519Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9762680WIN-5T344G8GM1HS-1-5-181/19/2018 9:41:32 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{C631DF4C-088F-4156-B058-4375F0853CD8}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904518Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9762680WIN-5T344G8GM1HS-1-5-181/19/2018 9:41:32 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{C418DD9D-0D14-4efb-8FBF-CFE535C8FAC7}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904517Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9762680WIN-5T344G8GM1HS-1-5-181/19/2018 9:41:32 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{C34B2751-1CF4-44F5-9262-C3FC39666591}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904516Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9762680WIN-5T344G8GM1HS-1-5-181/19/2018 9:41:32 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{BC75B1ED-5833-4858-9BB8-CBF0B166DF9D}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904515Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9762680WIN-5T344G8GM1HS-1-5-181/19/2018 9:41:32 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{BA649533-0AAC-4E04-B9BC-4DBAE0325B12}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904514Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9762680WIN-5T344G8GM1HS-1-5-181/19/2018 9:41:32 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{B587E2B1-4D59-4e7e-AED9-22B9DF11D053}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904513Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9762680WIN-5T344G8GM1HS-1-5-181/19/2018 9:41:32 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{B087BE9D-ED37-454f-AF9C-04291E351182}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904512Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9762680WIN-5T344G8GM1HS-1-5-181/19/2018 9:41:32 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{AADCED64-746C-4633-A97C-D61349046527}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904511Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9762680WIN-5T344G8GM1HS-1-5-181/19/2018 9:41:32 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{A3F3E39B-5D83-4940-B954-28315B82F0A8}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904510Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9762680WIN-5T344G8GM1HS-1-5-181/19/2018 9:41:32 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{91FBB303-0CD5-4055-BF42-E512A681B325}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904509Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9762680WIN-5T344G8GM1HS-1-5-181/19/2018 9:41:32 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{8A28E2C5-8D06-49A4-A08C-632DAA493E17}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904508Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9762680WIN-5T344G8GM1HS-1-5-181/19/2018 9:41:32 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{827D319E-6EAC-11D2-A4EA-00C04F79F83A}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904507Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9762680WIN-5T344G8GM1HS-1-5-181/19/2018 9:41:32 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{7B849a69-220F-451E-B3FE-2CB811AF94AE}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904506Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9762680WIN-5T344G8GM1HS-1-5-181/19/2018 9:41:32 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{7933F41E-56F8-41d6-A31C-4148A711EE93}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904505Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9762680WIN-5T344G8GM1HS-1-5-181/19/2018 9:41:32 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{74EE6C03-5363-4554-B161-627540339CAB}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904504Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9762680WIN-5T344G8GM1HS-1-5-181/19/2018 9:41:32 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{728EE579-943C-4519-9EF7-AB56765798ED}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904503Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9762680WIN-5T344G8GM1HS-1-5-181/19/2018 9:41:32 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{7150F9BF-48AD-4da4-A49C-29EF4A8369BA}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904502Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9762680WIN-5T344G8GM1HS-1-5-181/19/2018 9:41:32 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{6A4C88C6-C502-4f74-8F60-2CB23EDC24E2}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904501Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9762680WIN-5T344G8GM1HS-1-5-181/19/2018 9:41:32 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{6232C319-91AC-4931-9385-E70C2B099F0E}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904500Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9762680WIN-5T344G8GM1HS-1-5-181/19/2018 9:41:32 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{4CFB60C1-FAA6-47f1-89AA-0B18730C9FD3}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904499Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9762680WIN-5T344G8GM1HS-1-5-181/19/2018 9:41:32 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{4bcd6cde-777b-48b6-9804-43568e23545d}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904498Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9762680WIN-5T344G8GM1HS-1-5-181/19/2018 9:41:32 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{4B7C3B0F-E993-4E06-A241-3FBE06943684}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904497Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9762680WIN-5T344G8GM1HS-1-5-181/19/2018 9:41:32 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{42B5FAAE-6536-11d2-AE5A-0000F87571E3}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904496Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9762680WIN-5T344G8GM1HS-1-5-181/19/2018 9:41:32 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{426031c0-0b47-4852-b0ca-ac3d37bfcb39}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904495Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9762680WIN-5T344G8GM1HS-1-5-181/19/2018 9:41:32 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{3A0DBA37-F8B2-4356-83DE-3E90BD5C261F}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904494Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9762680WIN-5T344G8GM1HS-1-5-181/19/2018 9:41:32 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{3610eda5-77ef-11d2-8dc5-00c04fa31a66}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904493Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9762680WIN-5T344G8GM1HS-1-5-181/19/2018 9:41:32 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{2BFCC077-22D2-48DE-BDE1-2F618D9B476D}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904492Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9762680WIN-5T344G8GM1HS-1-5-181/19/2018 9:41:32 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{2A8FDC61-2347-4C87-92F6-B05EB91A201A}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904491Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9762680WIN-5T344G8GM1HS-1-5-181/19/2018 9:41:32 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{1A6364EB-776B-4120-ADE1-B63A406A76B5}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904490Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9762680WIN-5T344G8GM1HS-1-5-181/19/2018 9:41:32 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{17D89FEC-5C44-4972-B12D-241CAEF74509}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904489Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9762680WIN-5T344G8GM1HS-1-5-181/19/2018 9:41:32 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{16be69fa-4209-4250-88cb-716cf41954e0}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904488Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9762680WIN-5T344G8GM1HS-1-5-181/19/2018 9:41:32 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{169EBF44-942F-4C43-87CE-13C93996EBBE}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904487Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9762680WIN-5T344G8GM1HS-1-5-181/19/2018 9:41:32 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{0E28E245-9368-4853-AD84-6DA3BA35BB75}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904486Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9762680WIN-5T344G8GM1HS-1-5-181/19/2018 9:41:32 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{0ACDD40C-75AC-47ab-BAA0-BF6DE7E7FE63}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904485Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9762680WIN-5T344G8GM1HS-1-5-181/19/2018 9:41:32 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2776; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll585700004611686018427387904484Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational27762848WIN-5T344G8GM1HS-1-5-201/19/2018 9:41:31 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 2204; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\virtualization\v2 : Msvm_ResourcePoolComponent.Name="Microsoft|RDV Integration Component Resource Pool|V2.0"; ResultCode = 0x80041010; PossibleCause = Unknown585802004611686018427387904483Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9762692WIN-5T344G8GM1HS-1-5-181/19/2018 9:41:30 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3176; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll585700004611686018427387904482Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational31761548WIN-5T344G8GM1HS-1-5-201/19/2018 9:40:26 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3952; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\interop\ms_409 : MSFTSM_RegisteredSubprofile; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904481Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9564728WIN-5T344G8GM1HS-1-5-181/19/2018 9:38:50 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3952; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\interop\ms_409 : MSFTSM_SubProfileRequiresProfile; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904480Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9564728WIN-5T344G8GM1HS-1-5-181/19/2018 9:38:50 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3952; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\interop\ms_409 : MSFTSM_RegisteredProfile; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904479Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9564728WIN-5T344G8GM1HS-1-5-181/19/2018 9:38:50 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3952; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\interop\ms_409 : MSFTSM_ReferencedProfile; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904478Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9564728WIN-5T344G8GM1HS-1-5-181/19/2018 9:38:50 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3952; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\interop\ms_409 : MSFTSM_ElementSoftwareIdentity; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904477Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9564728WIN-5T344G8GM1HS-1-5-181/19/2018 9:38:50 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3952; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\interop\ms_409 : MSFTSM_ElementConformsToProfileEx; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904476Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9564728WIN-5T344G8GM1HS-1-5-181/19/2018 9:38:50 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3952; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\interop\ms_409 : MSFTSM_ElementConformsToProfile; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904475Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9564728WIN-5T344G8GM1HS-1-5-181/19/2018 9:38:50 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3952; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\cimv2\storage\ms_409 : __Namespace.Name='iscsitarget'; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904474Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9564728WIN-5T344G8GM1HS-1-5-181/19/2018 9:38:50 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WMIProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3968; ProviderPath = %systemroot%\system32\wbem\wmiprov.dll585700004611686018427387904473Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational39684084WIN-5T344G8GM1HS-1-5-181/19/2018 9:38:50 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
MSVDS__PROVIDER provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2712; ProviderPath = %systemroot%\system32\wbem\vdswmi.dll585700004611686018427387904472Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational2712592WIN-5T344G8GM1HS-1-5-201/19/2018 9:38:50 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2712; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll585700004611686018427387904471Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational2712592WIN-5T344G8GM1HS-1-5-201/19/2018 9:38:49 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
nettcpip provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4348; ProviderPath = %systemroot%\system32\wbem\NetTCPIP.dll585700004611686018427387904470Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational43482924WIN-5T344G8GM1HS-1-5-201/19/2018 9:35:55 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NetAdapterCim provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4444; ProviderPath = %systemroot%\system32\wbem\NetAdapterCim.dll585700004611686018427387904469Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational44444516WIN-5T344G8GM1HS-1-5-191/19/2018 9:35:55 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4348; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll585700004611686018427387904468Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational43484632WIN-5T344G8GM1HS-1-5-201/19/2018 9:35:55 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
MSVDS__PROVIDER provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4348; ProviderPath = %systemroot%\system32\wbem\vdswmi.dll585700004611686018427387904467Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational43484632WIN-5T344G8GM1HS-1-5-201/19/2018 9:35:41 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4348; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll585700004611686018427387904466Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational43484632WIN-5T344G8GM1HS-1-5-201/19/2018 9:35:41 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
nettcpip provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4824; ProviderPath = %systemroot%\system32\wbem\NetTCPIP.dll585700004611686018427387904465Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational48241600WIN-5T344G8GM1HS-1-5-201/19/2018 9:34:04 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NetAdapterCim provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1548; ProviderPath = %systemroot%\system32\wbem\NetAdapterCim.dll585700004611686018427387904464Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational15482160WIN-5T344G8GM1HS-1-5-191/19/2018 9:34:04 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4824; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll585700004611686018427387904463Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational48241600WIN-5T344G8GM1HS-1-5-201/19/2018 9:34:04 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4824; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll585700004611686018427387904462Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational48244808WIN-5T344G8GM1HS-1-5-201/19/2018 9:34:04 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 764; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll585700004611686018427387904461Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational7641020WIN-5T344G8GM1HS-1-5-181/19/2018 9:33:46 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
MSVDS__PROVIDER provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4824; ProviderPath = %systemroot%\system32\wbem\vdswmi.dll585700004611686018427387904460Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational48244808WIN-5T344G8GM1HS-1-5-201/19/2018 9:32:20 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4824; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll585700004611686018427387904459Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational48244808WIN-5T344G8GM1HS-1-5-201/19/2018 9:32:20 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WMIProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3968; ProviderPath = %systemroot%\system32\wbem\wmiprov.dll585700004611686018427387904458Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational39684084WIN-5T344G8GM1HS-1-5-181/19/2018 9:31:16 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
MSVDS__PROVIDER provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1520; ProviderPath = %systemroot%\system32\wbem\vdswmi.dll585700004611686018427387904457Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational15202704WIN-5T344G8GM1HS-1-5-201/19/2018 9:29:44 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1520; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll585700004611686018427387904456Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational15202704WIN-5T344G8GM1HS-1-5-201/19/2018 9:29:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {4693033F-66F0-46C4-8E27-99621765768B}; ClientMachine = WIN-5T344G8GM1H; User = WIN-5T344G8GM1H\Administrator; ClientProcessId = 4124; Component = Core; Operation = Start IWbemServices::ExecMethod - root\microsoft\windows\servermanager : MSFT_ServerManagerTasks::GetServerFeature; ResultCode = 0x800706BE; PossibleCause = Could not send status to client585802004611686018427387904455Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562716WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:32 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {4693033F-66F0-46C4-8E27-99621765768B}; ClientMachine = WIN-5T344G8GM1H; User = WIN-5T344G8GM1H\Administrator; ClientProcessId = 4124; Component = Unknown; Operation = Start IWbemServices::ExecMethod - root\microsoft\windows\servermanager : MSFT_ServerManagerTasks::GetServerFeature; ResultCode = 0x80041032; PossibleCause = Unknown585802004611686018427387904454Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational956432WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:32 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4608; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll585700004611686018427387904453Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational46084636WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:30 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
nettcpip provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2872; ProviderPath = %systemroot%\system32\wbem\NetTCPIP.dll585700004611686018427387904452Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational28722896WIN-5T344G8GM1HS-1-5-201/19/2018 9:27:26 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NetAdapterCim provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4344; ProviderPath = %systemroot%\system32\wbem\NetAdapterCim.dll585700004611686018427387904451Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational43444368WIN-5T344G8GM1HS-1-5-191/19/2018 9:27:26 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2872; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll585700004611686018427387904450Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational28722900WIN-5T344G8GM1HS-1-5-201/19/2018 9:27:25 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
MSVDS__PROVIDER provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2872; ProviderPath = %systemroot%\system32\wbem\vdswmi.dll585700004611686018427387904449Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational28722900WIN-5T344G8GM1HS-1-5-201/19/2018 9:27:20 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32a provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2872; ProviderPath = %systemroot%\system32\wbem\wmipcima.dll585700004611686018427387904448Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational28722900WIN-5T344G8GM1HS-1-5-201/19/2018 9:27:19 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Namespace = //./root/CIMV2; NotificationQuery = select * from MSFT_SCMEventLogEvent; OwnerName = S-1-5-32-544; HostProcessID = 956; Provider= SCM Event Provider, queryID = 0; PossibleCause = Permanent585900004611686018427387904447Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562284WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:18 AMaff0bd57-9107-0002-9bbd-f0af0791d301microsoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Namespace = root\virtualization\v2; NotificationQuery = SELECT * FROM __ClassOperationEvent; UserName = .\SYSTEM; ClientProcessID = 0, ClientMachine = ; PossibleCause = Temporary586000004611686018427387904446Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:18 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Namespace = //./root/subscription; Eventfilter = SCM Event Log Filter (refer to its activate eventid:5859); Consumer = NTEventLogEventConsumer="SCM Event Log Consumer"; PossibleCause = Binding EventFilter: instance of __EventFilter { CreatorSID = {1, 2, 0, 0, 0, 0, 0, 5, 32, 0, 0, 0, 32, 2, 0, 0}; EventNamespace = "root\\cimv2"; Name = "SCM Event Log Filter"; Query = "select * from MSFT_SCMEventLogEvent"; QueryLanguage = "WQL"; }; Perm. Consumer: instance of NTEventLogEventConsumer { Category = 0; CreatorSID = {1, 2, 0, 0, 0, 0, 0, 5, 32, 0, 0, 0, 32, 2, 0, 0}; EventType = 1; Name = "SCM Event Log Consumer"; NameOfUserSIDProperty = "sid"; SourceName = "Service Control Manager"; }; 586100004611686018427387904445Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562284WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:18 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{FC491EF1-C4AA-4CE1-B329-414B101DB823}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904444Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{fbf687e6-f063-4d9f-9f4f-fd9a26acdd5f}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904443Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{FB2CA36D-0B40-4307-821B-A13B252DE56C}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904442Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{f3ccc681-b74c-4060-9f26-cd84525dca2a}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904441Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{F312195E-3D9D-447A-A3F5-08DFFA24735E}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904440Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{E62688F0-25FD-4c90-BFF5-F508B9D2E31F}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904439Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{E5094040-C46C-4115-B030-04FB2E545B00}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904438Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{E4F48E54-F38D-4884-BFB9-D4D2E5729C18}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904437Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{e437bc1c-aa7d-11d2-a382-00c04f991e27}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904436Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{CF7639F3-ABA2-41DB-97F2-81E2C5DBFC5D}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904435Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{cdeafc3d-948d-49dd-ab12-e578ba4af7aa}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904434Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{c6dc5466-785a-11d2-84d0-00c04fb169f7}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904433Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{C631DF4C-088F-4156-B058-4375F0853CD8}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904432Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{C418DD9D-0D14-4efb-8FBF-CFE535C8FAC7}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904431Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{C34B2751-1CF4-44F5-9262-C3FC39666591}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904430Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{BC75B1ED-5833-4858-9BB8-CBF0B166DF9D}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904429Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{BA649533-0AAC-4E04-B9BC-4DBAE0325B12}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904428Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{B587E2B1-4D59-4e7e-AED9-22B9DF11D053}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904427Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{B087BE9D-ED37-454f-AF9C-04291E351182}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904426Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{AADCED64-746C-4633-A97C-D61349046527}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904425Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{A3F3E39B-5D83-4940-B954-28315B82F0A8}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904424Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{91FBB303-0CD5-4055-BF42-E512A681B325}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904423Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{8A28E2C5-8D06-49A4-A08C-632DAA493E17}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904422Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{827D319E-6EAC-11D2-A4EA-00C04F79F83A}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904421Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{7B849a69-220F-451E-B3FE-2CB811AF94AE}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904420Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562864WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{7933F41E-56F8-41d6-A31C-4148A711EE93}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904419Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562864WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{74EE6C03-5363-4554-B161-627540339CAB}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904418Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562864WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{728EE579-943C-4519-9EF7-AB56765798ED}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904417Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562864WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{7150F9BF-48AD-4da4-A49C-29EF4A8369BA}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904416Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562864WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{6A4C88C6-C502-4f74-8F60-2CB23EDC24E2}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904415Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562864WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{6232C319-91AC-4931-9385-E70C2B099F0E}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904414Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562864WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{4CFB60C1-FAA6-47f1-89AA-0B18730C9FD3}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904413Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562868WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{4bcd6cde-777b-48b6-9804-43568e23545d}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904412Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{4B7C3B0F-E993-4E06-A241-3FBE06943684}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904411Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{42B5FAAE-6536-11d2-AE5A-0000F87571E3}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904410Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562864WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{426031c0-0b47-4852-b0ca-ac3d37bfcb39}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904409Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562864WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{3A0DBA37-F8B2-4356-83DE-3E90BD5C261F}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904408Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562864WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{3610eda5-77ef-11d2-8dc5-00c04fa31a66}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904407Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562864WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{2BFCC077-22D2-48DE-BDE1-2F618D9B476D}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904406Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562864WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{2A8FDC61-2347-4C87-92F6-B05EB91A201A}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904405Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562868WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{1A6364EB-776B-4120-ADE1-B63A406A76B5}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904404Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562864WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{17D89FEC-5C44-4972-B12D-241CAEF74509}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904403Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562864WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{16be69fa-4209-4250-88cb-716cf41954e0}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904402Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562864WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{169EBF44-942F-4C43-87CE-13C93996EBBE}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904401Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{0E28E245-9368-4853-AD84-6DA3BA35BB75}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904400Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{0ACDD40C-75AC-47ab-BAA0-BF6DE7E7FE63}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904399Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{FC491EF1-C4AA-4CE1-B329-414B101DB823}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904398Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{fbf687e6-f063-4d9f-9f4f-fd9a26acdd5f}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904397Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{FB2CA36D-0B40-4307-821B-A13B252DE56C}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904396Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{f3ccc681-b74c-4060-9f26-cd84525dca2a}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904395Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{F312195E-3D9D-447A-A3F5-08DFFA24735E}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904394Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{E62688F0-25FD-4c90-BFF5-F508B9D2E31F}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904393Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{E5094040-C46C-4115-B030-04FB2E545B00}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904392Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{E4F48E54-F38D-4884-BFB9-D4D2E5729C18}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904391Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{e437bc1c-aa7d-11d2-a382-00c04f991e27}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904390Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{CF7639F3-ABA2-41DB-97F2-81E2C5DBFC5D}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904389Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{cdeafc3d-948d-49dd-ab12-e578ba4af7aa}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904388Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{c6dc5466-785a-11d2-84d0-00c04fb169f7}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904387Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{C631DF4C-088F-4156-B058-4375F0853CD8}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904386Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{C418DD9D-0D14-4efb-8FBF-CFE535C8FAC7}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904385Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{C34B2751-1CF4-44F5-9262-C3FC39666591}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904384Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{BC75B1ED-5833-4858-9BB8-CBF0B166DF9D}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904383Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{BA649533-0AAC-4E04-B9BC-4DBAE0325B12}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904382Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{B587E2B1-4D59-4e7e-AED9-22B9DF11D053}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904381Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{B087BE9D-ED37-454f-AF9C-04291E351182}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904380Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{AADCED64-746C-4633-A97C-D61349046527}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904379Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{A3F3E39B-5D83-4940-B954-28315B82F0A8}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904378Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{91FBB303-0CD5-4055-BF42-E512A681B325}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904377Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{8A28E2C5-8D06-49A4-A08C-632DAA493E17}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904376Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{827D319E-6EAC-11D2-A4EA-00C04F79F83A}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904375Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{7B849a69-220F-451E-B3FE-2CB811AF94AE}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904374Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{7933F41E-56F8-41d6-A31C-4148A711EE93}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904373Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{74EE6C03-5363-4554-B161-627540339CAB}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904372Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{728EE579-943C-4519-9EF7-AB56765798ED}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904371Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{7150F9BF-48AD-4da4-A49C-29EF4A8369BA}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904370Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{6A4C88C6-C502-4f74-8F60-2CB23EDC24E2}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904369Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{6232C319-91AC-4931-9385-E70C2B099F0E}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904368Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{4CFB60C1-FAA6-47f1-89AA-0B18730C9FD3}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904367Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{4bcd6cde-777b-48b6-9804-43568e23545d}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904366Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{4B7C3B0F-E993-4E06-A241-3FBE06943684}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904365Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{42B5FAAE-6536-11d2-AE5A-0000F87571E3}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904364Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{426031c0-0b47-4852-b0ca-ac3d37bfcb39}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904363Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{3A0DBA37-F8B2-4356-83DE-3E90BD5C261F}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904362Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{3610eda5-77ef-11d2-8dc5-00c04fa31a66}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904361Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{2BFCC077-22D2-48DE-BDE1-2F618D9B476D}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904360Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{2A8FDC61-2347-4C87-92F6-B05EB91A201A}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904359Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{1A6364EB-776B-4120-ADE1-B63A406A76B5}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904358Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{17D89FEC-5C44-4972-B12D-241CAEF74509}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904357Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{16be69fa-4209-4250-88cb-716cf41954e0}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904356Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{169EBF44-942F-4C43-87CE-13C93996EBBE}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904355Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{0E28E245-9368-4853-AD84-6DA3BA35BB75}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904354Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{0ACDD40C-75AC-47ab-BAA0-BF6DE7E7FE63}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904353Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2872; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll585700004611686018427387904352Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational28722900WIN-5T344G8GM1HS-1-5-201/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 2336; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\virtualization\v2 : Msvm_ResourcePoolComponent.Name="Microsoft|RDV Integration Component Resource Pool|V2.0"; ResultCode = 0x80041010; PossibleCause = Unknown585802004611686018427387904351Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562864WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Namespace = ROOT\virtualization\v2; NotificationQuery = SELECT * FROM __ClassOperationEvent; UserName = .\SYSTEM; ClientProcessID = 0, ClientMachine = ; PossibleCause = Temporary586000004611686018427387904350Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9682820WIN-5T344G8GM1HS-1-5-181/19/2018 9:26:58 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 2360; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\virtualization\v2 : Msvm_ResourcePoolComponent.Name="Microsoft|RDV Integration Component Resource Pool|V2.0"; ResultCode = 0x80041010; PossibleCause = Unknown585802004611686018427387904349Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9682820WIN-5T344G8GM1HS-1-5-181/19/2018 9:26:52 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\HyperVCluster\v2 : Msvm_VirtualHardDiskState; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904348Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9682820WIN-5T344G8GM1HS-1-5-181/19/2018 9:26:51 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\HyperVCluster\v2 : Msvm_VirtualHardDiskSettingData; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904347Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9682820WIN-5T344G8GM1HS-1-5-181/19/2018 9:26:51 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\HyperVCluster\v2 : Msvm_VirtualHardDiskInfo; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904346Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9682820WIN-5T344G8GM1HS-1-5-181/19/2018 9:26:51 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\HyperVCluster\v2 : Msvm_ServicingSettings; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904345Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9682820WIN-5T344G8GM1HS-1-5-181/19/2018 9:26:51 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\HyperVCluster\v2 : CIM_SettingsDefineState; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904344Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9682820WIN-5T344G8GM1HS-1-5-181/19/2018 9:26:51 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\HyperVCluster\v2 : CIM_ServiceAffectsElement; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904343Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9682820WIN-5T344G8GM1HS-1-5-181/19/2018 9:26:51 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\HyperVCluster\v2 : CIM_ManagedElement; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904342Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9682820WIN-5T344G8GM1HS-1-5-181/19/2018 9:26:51 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\HyperVCluster\v2 : CIM_ElementSettingData; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904341Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9682820WIN-5T344G8GM1HS-1-5-181/19/2018 9:26:51 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\HyperVCluster\v2 : CIM_ElementCapabilities; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904340Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9682820WIN-5T344G8GM1HS-1-5-181/19/2018 9:26:51 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\HyperVCluster\v2 : CIM_Dependency; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904339Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9682820WIN-5T344G8GM1HS-1-5-181/19/2018 9:26:51 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\HyperVCluster\v2 : CIM_Component; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904338Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9682820WIN-5T344G8GM1HS-1-5-181/19/2018 9:26:51 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\HyperVCluster\v2 : CIM_AffectedJobElement; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904337Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9682820WIN-5T344G8GM1HS-1-5-181/19/2018 9:26:51 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\HyperVCluster\v2\ms_409 : Msvm_SummaryInformationBase; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904336Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9682820WIN-5T344G8GM1HS-1-5-181/19/2018 9:26:51 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\HyperVCluster\v2\ms_409 : CIM_SettingsDefineState; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904335Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9682820WIN-5T344G8GM1HS-1-5-181/19/2018 9:26:51 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\HyperVCluster\v2\ms_409 : CIM_ServiceAffectsElement; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904334Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9682824WIN-5T344G8GM1HS-1-5-181/19/2018 9:26:51 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\HyperVCluster\v2\ms_409 : CIM_ManagedElement; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904333Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9682820WIN-5T344G8GM1HS-1-5-181/19/2018 9:26:51 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\HyperVCluster\v2\ms_409 : CIM_ElementSettingData; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904332Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9682820WIN-5T344G8GM1HS-1-5-181/19/2018 9:26:51 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\HyperVCluster\v2\ms_409 : CIM_ElementCapabilities; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904331Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9682820WIN-5T344G8GM1HS-1-5-181/19/2018 9:26:51 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\HyperVCluster\v2\ms_409 : CIM_Dependency; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904330Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9682820WIN-5T344G8GM1HS-1-5-181/19/2018 9:26:51 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\HyperVCluster\v2\ms_409 : CIM_Component; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904329Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9682820WIN-5T344G8GM1HS-1-5-181/19/2018 9:26:51 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\HyperVCluster\v2\ms_409 : CIM_AffectedJobElement; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904328Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9682820WIN-5T344G8GM1HS-1-5-181/19/2018 9:26:51 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Namespace = //./root/CIMV2; NotificationQuery = select * from MSFT_SCMEventLogEvent; OwnerName = S-1-5-32-544; HostProcessID = 968; Provider= SCM Event Provider, queryID = 0; PossibleCause = Permanent585900004611686018427387904327Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9682948WIN-5T344G8GM1HS-1-5-181/19/2018 9:26:51 AM96ed06e7-9107-0000-3d07-ed960791d301microsoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Namespace = //./root/subscription; Eventfilter = SCM Event Log Filter (refer to its activate eventid:5859); Consumer = NTEventLogEventConsumer="SCM Event Log Consumer"; PossibleCause = Binding EventFilter: instance of __EventFilter { CreatorSID = {1, 2, 0, 0, 0, 0, 0, 5, 32, 0, 0, 0, 32, 2, 0, 0}; EventNamespace = "root\\cimv2"; Name = "SCM Event Log Filter"; Query = "select * from MSFT_SCMEventLogEvent"; QueryLanguage = "WQL"; }; Perm. Consumer: instance of NTEventLogEventConsumer { Category = 0; CreatorSID = {1, 2, 0, 0, 0, 0, 0, 5, 32, 0, 0, 0, 32, 2, 0, 0}; EventType = 1; Name = "SCM Event Log Consumer"; NameOfUserSIDProperty = "sid"; SourceName = "Service Control Manager"; }; 586100004611686018427387904326Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9682948WIN-5T344G8GM1HS-1-5-181/19/2018 9:26:51 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2 : Msvm_VirtualDiskChangedRange; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904325Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9682820WIN-5T344G8GM1HS-1-5-181/19/2018 9:26:50 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2 : Msvm_VHDSSnapshotInformation; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904324Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9682820WIN-5T344G8GM1HS-1-5-181/19/2018 9:26:50 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2 : Msvm_VHDSetInformation; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904323Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9682820WIN-5T344G8GM1HS-1-5-181/19/2018 9:26:50 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2 : Msvm_VirtualHardDiskSettingData; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904322Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9682820WIN-5T344G8GM1HS-1-5-181/19/2018 9:26:50 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2 : Msvm_VirtualHardDiskInfo; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904321Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9682820WIN-5T344G8GM1HS-1-5-181/19/2018 9:26:50 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2 : Msvm_SummaryInformationBase; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904320Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9682820WIN-5T344G8GM1HS-1-5-181/19/2018 9:26:50 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2 : Msvm_ServicingSettings; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904319Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9682820WIN-5T344G8GM1HS-1-5-181/19/2018 9:26:50 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2 : CIM_SettingsDefineState; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904318Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9682820WIN-5T344G8GM1HS-1-5-181/19/2018 9:26:50 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2 : CIM_ServiceAffectsElement; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904317Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9682820WIN-5T344G8GM1HS-1-5-181/19/2018 9:26:50 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2 : CIM_ManagedElement; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904316Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9682820WIN-5T344G8GM1HS-1-5-181/19/2018 9:26:50 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2 : CIM_ElementSettingData; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904315Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9682820WIN-5T344G8GM1HS-1-5-181/19/2018 9:26:50 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2 : CIM_ElementCapabilities; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904314Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9682820WIN-5T344G8GM1HS-1-5-181/19/2018 9:26:50 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2 : CIM_Dependency; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904313Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9682820WIN-5T344G8GM1HS-1-5-181/19/2018 9:26:50 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2 : CIM_Component; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904312Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9682820WIN-5T344G8GM1HS-1-5-181/19/2018 9:26:50 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2 : CIM_AffectedJobElement; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904311Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9682820WIN-5T344G8GM1HS-1-5-181/19/2018 9:26:50 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2\ms_409 : Msvm_VirtualDiskChangedRange; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904310Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9682820WIN-5T344G8GM1HS-1-5-181/19/2018 9:26:49 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2\ms_409 : Msvm_VHDSSnapshotInformation; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904309Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9682820WIN-5T344G8GM1HS-1-5-181/19/2018 9:26:49 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2\ms_409 : Msvm_VHDSetInformation; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904308Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9682820WIN-5T344G8GM1HS-1-5-181/19/2018 9:26:49 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2\ms_409 : Msvm_VirtualHardDiskSettingData; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904307Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9682820WIN-5T344G8GM1HS-1-5-181/19/2018 9:26:49 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2\ms_409 : Msvm_VirtualHardDiskInfo; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904306Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9682820WIN-5T344G8GM1HS-1-5-181/19/2018 9:26:49 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2\ms_409 : Msvm_SummaryInformationBase; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904305Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9682820WIN-5T344G8GM1HS-1-5-181/19/2018 9:26:49 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2\ms_409 : Msvm_ServicingSettings; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904304Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9682820WIN-5T344G8GM1HS-1-5-181/19/2018 9:26:49 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2\ms_409 : CIM_SettingsDefineState; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904303Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9682820WIN-5T344G8GM1HS-1-5-181/19/2018 9:26:49 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2\ms_409 : CIM_ServiceAffectsElement; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904302Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9682820WIN-5T344G8GM1HS-1-5-181/19/2018 9:26:49 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2\ms_409 : CIM_ManagedElement; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904301Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9682820WIN-5T344G8GM1HS-1-5-181/19/2018 9:26:49 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2\ms_409 : CIM_ElementSettingData; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904300Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9682820WIN-5T344G8GM1HS-1-5-181/19/2018 9:26:49 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2\ms_409 : CIM_ElementCapabilities; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904299Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9682820WIN-5T344G8GM1HS-1-5-181/19/2018 9:26:49 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2\ms_409 : CIM_Dependency; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904298Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9682820WIN-5T344G8GM1HS-1-5-181/19/2018 9:26:49 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2\ms_409 : CIM_Component; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904297Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9682820WIN-5T344G8GM1HS-1-5-181/19/2018 9:26:49 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2\ms_409 : CIM_AffectedJobElement; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904296Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9682820WIN-5T344G8GM1HS-1-5-181/19/2018 9:26:49 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
MSVDS__PROVIDER provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2840; ProviderPath = %systemroot%\system32\wbem\vdswmi.dll585700004611686018427387904295Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational28402880WIN-5T344G8GM1HS-1-5-201/19/2018 9:26:46 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32a provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2840; ProviderPath = %systemroot%\system32\wbem\wmipcima.dll585700004611686018427387904294Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational28402880WIN-5T344G8GM1HS-1-5-201/19/2018 9:26:44 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2840; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll585700004611686018427387904293Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational28402864WIN-5T344G8GM1HS-1-5-201/19/2018 9:26:42 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 308; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_ComputerSystem; ResultCode = 0x80041032; PossibleCause = Unknown585802004611686018427387904292Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562620WIN-5T344G8GM1HS-1-5-181/19/2018 9:25:03 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 308; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_ComputerSystem; ResultCode = 0x80041032; PossibleCause = Unknown585802004611686018427387904291Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational956404WIN-5T344G8GM1HS-1-5-181/19/2018 9:25:02 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2528; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll585700004611686018427387904290Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational25283456WIN-5T344G8GM1HS-1-5-181/19/2018 9:24:56 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
nettcpip provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2508; ProviderPath = %systemroot%\system32\wbem\NetTCPIP.dll585700004611686018427387904289Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational25084092WIN-5T344G8GM1HS-1-5-201/19/2018 9:24:53 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NetAdapterCim provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2736; ProviderPath = %systemroot%\system32\wbem\NetAdapterCim.dll585700004611686018427387904288Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational27363804WIN-5T344G8GM1HS-1-5-191/19/2018 9:24:53 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2508; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll585700004611686018427387904287Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational25084092WIN-5T344G8GM1HS-1-5-201/19/2018 9:24:53 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2508; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll585700004611686018427387904286Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational25082824WIN-5T344G8GM1HS-1-5-201/19/2018 9:24:53 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3200; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll585700004611686018427387904285Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational32003644WIN-5T344G8GM1HS-1-5-181/19/2018 9:23:15 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
nettcpip provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2856; ProviderPath = %systemroot%\system32\wbem\NetTCPIP.dll585700004611686018427387904284Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational28562920WIN-5T344G8GM1HS-1-5-201/19/2018 9:23:12 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NetAdapterCim provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2540; ProviderPath = %systemroot%\system32\wbem\NetAdapterCim.dll585700004611686018427387904283Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational25403240WIN-5T344G8GM1HS-1-5-191/19/2018 9:23:12 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2856; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll585700004611686018427387904282Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational28562884WIN-5T344G8GM1HS-1-5-201/19/2018 9:23:11 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
MSVDS__PROVIDER provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2856; ProviderPath = %systemroot%\system32\wbem\vdswmi.dll585700004611686018427387904281Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational28562884WIN-5T344G8GM1HS-1-5-201/19/2018 9:23:05 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32a provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2856; ProviderPath = %systemroot%\system32\wbem\wmipcima.dll585700004611686018427387904280Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational28562884WIN-5T344G8GM1HS-1-5-201/19/2018 9:23:04 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Namespace = //./root/CIMV2; NotificationQuery = select * from MSFT_SCMEventLogEvent; OwnerName = S-1-5-32-544; HostProcessID = 956; Provider= SCM Event Provider, queryID = 0; PossibleCause = Permanent585900004611686018427387904279Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562916WIN-5T344G8GM1HS-1-5-181/19/2018 9:23:03 AM17f2f0cc-9107-0002-12f1-f2170791d301microsoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Namespace = //./root/subscription; Eventfilter = SCM Event Log Filter (refer to its activate eventid:5859); Consumer = NTEventLogEventConsumer="SCM Event Log Consumer"; PossibleCause = Binding EventFilter: instance of __EventFilter { CreatorSID = {1, 2, 0, 0, 0, 0, 0, 5, 32, 0, 0, 0, 32, 2, 0, 0}; EventNamespace = "root\\cimv2"; Name = "SCM Event Log Filter"; Query = "select * from MSFT_SCMEventLogEvent"; QueryLanguage = "WQL"; }; Perm. Consumer: instance of NTEventLogEventConsumer { Category = 0; CreatorSID = {1, 2, 0, 0, 0, 0, 0, 5, 32, 0, 0, 0, 32, 2, 0, 0}; EventType = 1; Name = "SCM Event Log Consumer"; NameOfUserSIDProperty = "sid"; SourceName = "Service Control Manager"; }; 586100004611686018427387904278Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562908WIN-5T344G8GM1HS-1-5-181/19/2018 9:23:03 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2856; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll585700004611686018427387904277Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational28562884WIN-5T344G8GM1HS-1-5-201/19/2018 9:23:02 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3808; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll585700004611686018427387904276Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational38084032WIN-5T344G8GM1HS-1-5-181/19/2018 9:14:59 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
nettcpip provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2664; ProviderPath = %systemroot%\system32\wbem\NetTCPIP.dll585700004611686018427387904275Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational26642720WIN-5T344G8GM1HS-1-5-201/19/2018 9:14:58 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NetAdapterCim provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2972; ProviderPath = %systemroot%\system32\wbem\NetAdapterCim.dll585700004611686018427387904274Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational2972156WIN-5T344G8GM1HS-1-5-191/19/2018 9:14:58 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2664; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll585700004611686018427387904273Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational26642720WIN-5T344G8GM1HS-1-5-201/19/2018 9:14:57 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2664; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll585700004611686018427387904272Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational26641584WIN-5T344G8GM1HS-1-5-201/19/2018 9:14:57 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = WIN-5T344G8GM1H\Administrator; ClientProcessId = 1860; Component = Unknown; Operation = Start IWbemServices::PutInstance - root\cimv2 : Win32_ComputerSystem.Name="WIN-5T344G8GM1H"; ResultCode = 0x80041001; PossibleCause = Unknown585802004611686018427387904271Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational11804136WIN-5T344G8GM1HS-1-5-181/19/2018 9:11:39 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4368; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll585700004611686018427387904270Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational43684496WIN-5T344G8GM1HS-1-5-201/19/2018 9:10:55 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1784; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll585700004611686018427387904269Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational17842240WIN-5T344G8GM1HS-1-5-181/19/2018 9:05:00 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
nettcpip provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 952; ProviderPath = %systemroot%\system32\wbem\NetTCPIP.dll585700004611686018427387904268Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational952452WIN-5T344G8GM1HS-1-5-201/19/2018 9:04:58 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NetAdapterCim provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1152; ProviderPath = %systemroot%\system32\wbem\NetAdapterCim.dll585700004611686018427387904267Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational11521396WIN-5T344G8GM1HS-1-5-191/19/2018 9:04:58 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 952; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll585700004611686018427387904266Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational952452WIN-5T344G8GM1HS-1-5-201/19/2018 9:04:57 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 952; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll585700004611686018427387904265Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9521000WIN-5T344G8GM1HS-1-5-201/19/2018 9:04:57 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WMIProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3176; ProviderPath = %systemroot%\system32\wbem\wmiprov.dll585700004611686018427387904264Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational31763364WIN-5T344G8GM1HS-1-5-181/19/2018 8:58:49 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
MSVDS__PROVIDER provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4672; ProviderPath = %systemroot%\system32\wbem\vdswmi.dll585700004611686018427387904263Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational46724700WIN-5T344G8GM1HS-1-5-201/19/2018 8:57:50 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4672; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll585700004611686018427387904262Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational46724700WIN-5T344G8GM1HS-1-5-201/19/2018 8:57:50 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 88; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_ComputerSystemProduct; ResultCode = 0x80041032; PossibleCause = Unknown585802004611686018427387904261Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational11801284WIN-5T344G8GM1HS-1-5-181/19/2018 8:56:50 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4672; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll585700004611686018427387904260Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational46724700WIN-5T344G8GM1HS-1-5-201/19/2018 8:56:50 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Namespace = //./root/CIMV2; NotificationQuery = select * from MSFT_SCMEventLogEvent; OwnerName = S-1-5-32-544; HostProcessID = 1180; Provider= SCM Event Provider, queryID = 0; PossibleCause = Permanent585900004611686018427387904259Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational11804340WIN-5T344G8GM1HS-1-5-181/19/2018 8:56:46 AM289cfce6-9103-0003-f9fd-9c280391d301microsoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Namespace = //./root/subscription; Eventfilter = SCM Event Log Filter (refer to its activate eventid:5859); Consumer = NTEventLogEventConsumer="SCM Event Log Consumer"; PossibleCause = Binding EventFilter: instance of __EventFilter { CreatorSID = {1, 2, 0, 0, 0, 0, 0, 5, 32, 0, 0, 0, 32, 2, 0, 0}; EventNamespace = "root\\cimv2"; Name = "SCM Event Log Filter"; Query = "select * from MSFT_SCMEventLogEvent"; QueryLanguage = "WQL"; }; Perm. Consumer: instance of NTEventLogEventConsumer { Category = 0; CreatorSID = {1, 2, 0, 0, 0, 0, 0, 5, 32, 0, 0, 0, 32, 2, 0, 0}; EventType = 1; Name = "SCM Event Log Consumer"; NameOfUserSIDProperty = "sid"; SourceName = "Service Control Manager"; }; 586100004611686018427387904258Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational11804340WIN-5T344G8GM1HS-1-5-181/19/2018 8:56:46 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
MSVDS__PROVIDER provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3968; ProviderPath = %systemroot%\system32\wbem\vdswmi.dll585700004611686018427387904257Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational39684008WIN-5T344G8GM1HS-1-5-201/19/2018 8:55:06 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32a provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3968; ProviderPath = %systemroot%\system32\wbem\wmipcima.dll585700004611686018427387904256Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational39684008WIN-5T344G8GM1HS-1-5-201/19/2018 8:55:05 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3688; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll585700004611686018427387904255Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational36883696WIN-5T344G8GM1HS-1-5-181/19/2018 8:55:04 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
nettcpip provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3968; ProviderPath = %systemroot%\system32\wbem\NetTCPIP.dll585700004611686018427387904254Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational39684020WIN-5T344G8GM1HS-1-5-201/19/2018 8:54:58 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NetAdapterCim provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4024; ProviderPath = %systemroot%\system32\wbem\NetAdapterCim.dll585700004611686018427387904253Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational40244052WIN-5T344G8GM1HS-1-5-191/19/2018 8:54:58 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3968; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll585700004611686018427387904252Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational39684008WIN-5T344G8GM1HS-1-5-201/19/2018 8:54:58 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3968; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll585700004611686018427387904251Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational39683996WIN-5T344G8GM1HS-1-5-201/19/2018 8:54:58 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3880; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll585700004611686018427387904250Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational38803916WIN-5T344G8GM1HS-1-5-201/19/2018 8:54:38 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {7C5C4FFB-9102-0000-4A51-5C7C0291D301}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 1192; Component = Unknown; Operation = Start IWbemServices::ExecNotificationQuery - ROOT\CIMV2 : SELECT * FROM Win32_ProcessStartTrace WHERE ProcessName = 'wsmprovhost.exe'; ResultCode = 0x80041032; PossibleCause = Unknown585802004611686018427387904249Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational11923004WIN-5T344G8GM1HS-1-5-181/19/2018 8:54:34 AM7c5c4ffb-9102-0000-4a51-5c7c0291d301microsoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WMIProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1200; ProviderPath = %systemroot%\system32\wbem\wmiprov.dll585700004611686018427387904248Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational12002840WIN-5T344G8GM1HS-1-5-181/19/2018 8:54:03 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Namespace = ROOT\CIMV2; NotificationQuery = SELECT * FROM Win32_ProcessStartTrace WHERE ProcessName = 'wsmprovhost.exe'; UserName = ; ClientProcessID = 1192, ClientMachine = WIN-5T344G8GM1H; PossibleCause = Temporary586000004611686018427387904247Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational11922792WIN-5T344G8GM1HS-1-5-181/19/2018 8:52:27 AM7c5c4ffb-9102-0001-8851-5c7c0291d301microsoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WMI Kernel Trace Event Provider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1192; ProviderPath = C:\Windows\System32\wbem\krnlprov.dll585700004611686018427387904246Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational11922792WIN-5T344G8GM1HS-1-5-181/19/2018 8:52:27 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Namespace = //./root/CIMV2; NotificationQuery = select * from MSFT_SCMEventLogEvent; OwnerName = S-1-5-32-544; HostProcessID = 1192; Provider= SCM Event Provider, queryID = 0; PossibleCause = Permanent585900004611686018427387904245Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational11922796WIN-5T344G8GM1HS-1-5-181/19/2018 8:51:57 AM7c5c4ffb-9102-0001-5f51-5c7c0291d301microsoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Namespace = //./root/subscription; Eventfilter = SCM Event Log Filter (refer to its activate eventid:5859); Consumer = NTEventLogEventConsumer="SCM Event Log Consumer"; PossibleCause = Binding EventFilter: instance of __EventFilter { CreatorSID = {1, 2, 0, 0, 0, 0, 0, 5, 32, 0, 0, 0, 32, 2, 0, 0}; EventNamespace = "root\\cimv2"; Name = "SCM Event Log Filter"; Query = "select * from MSFT_SCMEventLogEvent"; QueryLanguage = "WQL"; }; Perm. Consumer: instance of NTEventLogEventConsumer { Category = 0; CreatorSID = {1, 2, 0, 0, 0, 0, 0, 5, 32, 0, 0, 0, 32, 2, 0, 0}; EventType = 1; Name = "SCM Event Log Consumer"; NameOfUserSIDProperty = "sid"; SourceName = "Service Control Manager"; }; 586100004611686018427387904244Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational11922796WIN-5T344G8GM1HS-1-5-181/19/2018 8:51:57 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
MSVDS__PROVIDER provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3832; ProviderPath = %systemroot%\system32\wbem\vdswmi.dll585700004611686018427387904243Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational38323932WIN-5T344G8GM1HS-1-5-201/19/2018 8:51:38 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32a provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3832; ProviderPath = %systemroot%\system32\wbem\wmipcima.dll585700004611686018427387904242Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational38323872WIN-5T344G8GM1HS-1-5-201/19/2018 8:51:37 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 428; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll585700004611686018427387904241Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational4281316WIN-5T344G8GM1HS-1-5-181/19/2018 8:51:13 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
nettcpip provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3832; ProviderPath = %systemroot%\system32\wbem\NetTCPIP.dll585700004611686018427387904240Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational38323872WIN-5T344G8GM1HS-1-5-201/19/2018 8:51:04 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NetAdapterCim provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3888; ProviderPath = %systemroot%\system32\wbem\NetAdapterCim.dll585700004611686018427387904239Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational38883916WIN-5T344G8GM1HS-1-5-191/19/2018 8:51:04 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3832; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll585700004611686018427387904238Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational38323872WIN-5T344G8GM1HS-1-5-201/19/2018 8:51:04 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3832; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll585700004611686018427387904237Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational38323860WIN-5T344G8GM1HS-1-5-201/19/2018 8:51:04 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4796; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll585700004611686018427387904236Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational4796840WIN-5T344G8GM1HS-1-5-201/19/2018 8:45:55 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2284; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll585700004611686018427387904235Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational22842676WIN-5T344G8GM1HS-1-5-181/19/2018 8:44:15 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
nettcpip provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2548; ProviderPath = %systemroot%\system32\wbem\NetTCPIP.dll585700004611686018427387904234Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational25482728WIN-5T344G8GM1HS-1-5-201/19/2018 8:44:08 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NetAdapterCim provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2300; ProviderPath = %systemroot%\system32\wbem\NetAdapterCim.dll585700004611686018427387904233Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational23004360WIN-5T344G8GM1HS-1-5-191/19/2018 8:44:08 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2548; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll585700004611686018427387904232Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational25482728WIN-5T344G8GM1HS-1-5-201/19/2018 8:44:08 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2548; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll585700004611686018427387904231Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational25483736WIN-5T344G8GM1HS-1-5-201/19/2018 8:44:08 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1052; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll585700004611686018427387904230Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational10524868WIN-5T344G8GM1HS-1-5-201/19/2018 8:36:56 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3184; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll585700004611686018427387904229Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational3184404WIN-5T344G8GM1HS-1-5-181/19/2018 8:34:15 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Win32_WIN32_TERMINALSERVICE_Prov provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1164; ProviderPath = %SystemRoot%\system32\tscfgwmi.dll585700004611686018427387904228Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational11644616WIN-5T344G8GM1HS-1-5-201/19/2018 8:34:14 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4600; Component = Unknown; Operation = Start IWbemServices::ExecQuery - ROOT\WMI : SELECT * FROM BatteryStaticData; ResultCode = 0x80041010; PossibleCause = Unknown585802004611686018427387904227Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9644904WIN-5T344G8GM1HS-1-5-181/19/2018 8:34:14 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4600; Component = Unknown; Operation = Start IWbemServices::ExecQuery - ROOT\WMI : SELECT * FROM BatteryFullChargedCapacity; ResultCode = 0x80041010; PossibleCause = Unknown585802004611686018427387904226Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9644904WIN-5T344G8GM1HS-1-5-181/19/2018 8:34:13 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
PowerWmiProvider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1164; ProviderPath = %SYSTEMROOT%\system32\PowerWmiProvider.dll585700004611686018427387904225Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational11641368WIN-5T344G8GM1HS-1-5-201/19/2018 8:34:13 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
StorageWMI provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1164; ProviderPath = %SystemRoot%\System32\storagewmi.dll585700004611686018427387904224Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational11641368WIN-5T344G8GM1HS-1-5-201/19/2018 8:34:11 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
MSVDS__PROVIDER provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1164; ProviderPath = %systemroot%\system32\wbem\vdswmi.dll585700004611686018427387904223Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational11641368WIN-5T344G8GM1HS-1-5-201/19/2018 8:34:11 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
nettcpip provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1164; ProviderPath = %systemroot%\system32\wbem\NetTCPIP.dll585700004611686018427387904222Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational11641368WIN-5T344G8GM1HS-1-5-201/19/2018 8:34:08 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NetAdapterCim provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2920; ProviderPath = %systemroot%\system32\wbem\NetAdapterCim.dll585700004611686018427387904221Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational29204532WIN-5T344G8GM1HS-1-5-191/19/2018 8:34:08 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1164; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll585700004611686018427387904220Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational11641368WIN-5T344G8GM1HS-1-5-201/19/2018 8:34:08 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1164; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll585700004611686018427387904219Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational11641532WIN-5T344G8GM1HS-1-5-201/19/2018 8:34:08 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9A81CB05-910F-0003-8ACC-819A0F91D301}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 964; Component = Unknown; Operation = Start IWbemServices::ExecNotificationQuery - ROOT\CIMV2 : SELECT * FROM Win32_ProcessStartTrace WHERE ProcessName = 'wsmprovhost.exe'; ResultCode = 0x80041032; PossibleCause = Unknown585802004611686018427387904218Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9644228WIN-5T344G8GM1HS-1-5-181/19/2018 8:33:15 AM9a81cb05-910f-0003-8acc-819a0f91d301microsoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3976; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\Microsoft\Windows\DeviceGuard : SELECT RequiredSecurityProperties FROM Win32_DeviceGuard ; ResultCode = 0x80041032; PossibleCause = Unknown585802004611686018427387904217Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9641824WIN-5T344G8GM1HS-1-5-181/19/2018 8:33:01 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3976; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\Microsoft\Windows\DeviceGuard : SELECT SecurityServicesConfigured FROM Win32_DeviceGuard ; ResultCode = 0x80041032; PossibleCause = Unknown585802004611686018427387904216Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9645076WIN-5T344G8GM1HS-1-5-181/19/2018 8:33:01 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Win32_TpmProvider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1164; ProviderPath = C:\Windows\system32\wbem\Win32_TPM.dll585700004611686018427387904215Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational11641532WIN-5T344G8GM1HS-1-5-201/19/2018 8:33:01 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3976; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\Microsoft\Windows\DeviceGuard : SELECT VirtualizationBasedSecurityStatus FROM Win32_DeviceGuard ; ResultCode = 0x80041032; PossibleCause = Unknown585802004611686018427387904214Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9645076WIN-5T344G8GM1HS-1-5-181/19/2018 8:33:01 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3976; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\Microsoft\Windows\DeviceGuard : SELECT SecurityServicesRunning FROM Win32_DeviceGuard ; ResultCode = 0x80041032; PossibleCause = Unknown585802004611686018427387904213Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9645076WIN-5T344G8GM1HS-1-5-181/19/2018 8:33:01 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3976; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\Microsoft\Windows\DeviceGuard : SELECT AvailableSecurityProperties FROM Win32_DeviceGuard ; ResultCode = 0x80041032; PossibleCause = Unknown585802004611686018427387904212Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9641824WIN-5T344G8GM1HS-1-5-181/19/2018 8:33:01 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3976; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\Microsoft\Windows\DeviceGuard : SELECT RequiredSecurityProperties FROM Win32_DeviceGuard ; ResultCode = 0x80041032; PossibleCause = Unknown585802004611686018427387904211Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9645076WIN-5T344G8GM1HS-1-5-181/19/2018 8:33:01 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Win32_DeviceGuard provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1164; ProviderPath = %SystemRoot%\System32\Win32_DeviceGuard.dll585700004611686018427387904210Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational11641532WIN-5T344G8GM1HS-1-5-201/19/2018 8:33:01 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3976; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\CIMV2 : SELECT SMBIOSAssetTag FROM Win32_SystemEnclosure ; ResultCode = 0x80041032; PossibleCause = Unknown585802004611686018427387904209Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9645076WIN-5T344G8GM1HS-1-5-181/19/2018 8:32:59 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
MSVDS__PROVIDER provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1164; ProviderPath = %systemroot%\system32\wbem\vdswmi.dll585700004611686018427387904208Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational11641532WIN-5T344G8GM1HS-1-5-201/19/2018 8:32:59 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1164; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll585700004611686018427387904207Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational11642868WIN-5T344G8GM1HS-1-5-201/19/2018 8:32:58 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1912; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll585700004611686018427387904206Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational19123084WIN-5T344G8GM1HS-1-5-181/19/2018 8:32:58 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
ServerFeatureProvider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1164; ProviderPath = %windir%\system32\wbem\servercompprov.dll585700004611686018427387904205Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational11641532WIN-5T344G8GM1HS-1-5-201/19/2018 8:32:58 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
MSVDS__PROVIDER provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 996; ProviderPath = %systemroot%\system32\wbem\vdswmi.dll585700004611686018427387904204Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational996456WIN-5T344G8GM1HS-1-5-201/19/2018 8:29:00 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 996; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll585700004611686018427387904203Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational996456WIN-5T344G8GM1HS-1-5-201/19/2018 8:29:00 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WMIProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4324; ProviderPath = %systemroot%\system32\wbem\wmiprov.dll585700004611686018427387904202Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational43243568WIN-5T344G8GM1HS-1-5-181/19/2018 8:27:56 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Namespace = ROOT\CIMV2; NotificationQuery = SELECT * FROM Win32_ProcessStartTrace WHERE ProcessName = 'wsmprovhost.exe'; UserName = ; ClientProcessID = 964, ClientMachine = WIN-5T344G8GM1H; PossibleCause = Temporary586000004611686018427387904201Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9643260WIN-5T344G8GM1HS-1-5-181/19/2018 8:26:55 AM9a81cb05-910f-0000-a4cc-819a0f91d301microsoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WMI Kernel Trace Event Provider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 964; ProviderPath = C:\Windows\System32\wbem\krnlprov.dll585700004611686018427387904200Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9643260WIN-5T344G8GM1HS-1-5-181/19/2018 8:26:55 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
MSVDS__PROVIDER provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3772; ProviderPath = %systemroot%\system32\wbem\vdswmi.dll585700004611686018427387904199Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational37723768WIN-5T344G8GM1HS-1-5-201/19/2018 8:26:50 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3772; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll585700004611686018427387904198Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational37723768WIN-5T344G8GM1HS-1-5-201/19/2018 8:25:57 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Namespace = //./root/CIMV2; NotificationQuery = select * from MSFT_SCMEventLogEvent; OwnerName = S-1-5-32-544; HostProcessID = 964; Provider= SCM Event Provider, queryID = 0; PossibleCause = Permanent585900004611686018427387904197Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9644648WIN-5T344G8GM1HS-1-5-181/19/2018 8:25:52 AM9a81cb05-910f-0003-4bcc-819a0f91d301microsoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Namespace = //./root/subscription; Eventfilter = SCM Event Log Filter (refer to its activate eventid:5859); Consumer = NTEventLogEventConsumer="SCM Event Log Consumer"; PossibleCause = Binding EventFilter: instance of __EventFilter { CreatorSID = {1, 2, 0, 0, 0, 0, 0, 5, 32, 0, 0, 0, 32, 2, 0, 0}; EventNamespace = "root\\cimv2"; Name = "SCM Event Log Filter"; Query = "select * from MSFT_SCMEventLogEvent"; QueryLanguage = "WQL"; }; Perm. Consumer: instance of NTEventLogEventConsumer { Category = 0; CreatorSID = {1, 2, 0, 0, 0, 0, 0, 5, 32, 0, 0, 0, 32, 2, 0, 0}; EventType = 1; Name = "SCM Event Log Consumer"; NameOfUserSIDProperty = "sid"; SourceName = "Service Control Manager"; }; 586100004611686018427387904196Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9644648WIN-5T344G8GM1HS-1-5-181/19/2018 8:25:52 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
MSVDS__PROVIDER provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3772; ProviderPath = %systemroot%\system32\wbem\vdswmi.dll585700004611686018427387904195Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational37723768WIN-5T344G8GM1HS-1-5-201/19/2018 8:24:46 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4124; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll585700004611686018427387904194Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational41244152WIN-5T344G8GM1HS-1-5-181/19/2018 8:24:15 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
nettcpip provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3772; ProviderPath = %systemroot%\system32\wbem\NetTCPIP.dll585700004611686018427387904193Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational37723820WIN-5T344G8GM1HS-1-5-201/19/2018 8:24:08 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NetAdapterCim provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3084; ProviderPath = %systemroot%\system32\wbem\NetAdapterCim.dll585700004611686018427387904192Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational30843436WIN-5T344G8GM1HS-1-5-191/19/2018 8:24:08 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3772; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll585700004611686018427387904191Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational37723800WIN-5T344G8GM1HS-1-5-201/19/2018 8:24:08 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32a provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3772; ProviderPath = %systemroot%\system32\wbem\wmipcima.dll585700004611686018427387904190Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational37723800WIN-5T344G8GM1HS-1-5-201/19/2018 8:24:03 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3772; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll585700004611686018427387904189Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational37723800WIN-5T344G8GM1HS-1-5-201/19/2018 8:24:03 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3868; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll585700004611686018427387904188Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational38683176WIN-5T344G8GM1HS-1-5-181/16/2018 6:37:16 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
nettcpip provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2504; ProviderPath = %systemroot%\system32\wbem\NetTCPIP.dll585700004611686018427387904187Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational25042192WIN-5T344G8GM1HS-1-5-201/16/2018 6:37:14 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NetAdapterCim provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2788; ProviderPath = %systemroot%\system32\wbem\NetAdapterCim.dll585700004611686018427387904186Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational27882624WIN-5T344G8GM1HS-1-5-191/16/2018 6:37:14 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2504; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll585700004611686018427387904185Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational25042192WIN-5T344G8GM1HS-1-5-201/16/2018 6:37:14 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2504; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll585700004611686018427387904184Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational25042440WIN-5T344G8GM1HS-1-5-201/16/2018 6:37:14 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4024; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll585700004611686018427387904183Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational40243868WIN-5T344G8GM1HS-1-5-181/16/2018 6:27:16 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
nettcpip provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1288; ProviderPath = %systemroot%\system32\wbem\NetTCPIP.dll585700004611686018427387904182Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational12883280WIN-5T344G8GM1HS-1-5-201/16/2018 6:27:14 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NetAdapterCim provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1500; ProviderPath = %systemroot%\system32\wbem\NetAdapterCim.dll585700004611686018427387904181Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational15002664WIN-5T344G8GM1HS-1-5-191/16/2018 6:27:14 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1288; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll585700004611686018427387904180Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational12883280WIN-5T344G8GM1HS-1-5-201/16/2018 6:27:14 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1288; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll585700004611686018427387904179Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational12884056WIN-5T344G8GM1HS-1-5-201/16/2018 6:27:14 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 652; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll585700004611686018427387904178Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6521972WIN-5T344G8GM1HS-1-5-181/16/2018 6:17:16 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
nettcpip provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4032; ProviderPath = %systemroot%\system32\wbem\NetTCPIP.dll585700004611686018427387904177Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational40323152WIN-5T344G8GM1HS-1-5-201/16/2018 6:17:14 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NetAdapterCim provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3688; ProviderPath = %systemroot%\system32\wbem\NetAdapterCim.dll585700004611686018427387904176Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational36883124WIN-5T344G8GM1HS-1-5-191/16/2018 6:17:14 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4032; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll585700004611686018427387904175Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational40321184WIN-5T344G8GM1HS-1-5-201/16/2018 6:17:14 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4032; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll585700004611686018427387904174Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational40321160WIN-5T344G8GM1HS-1-5-201/16/2018 6:17:14 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WMIProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1088; ProviderPath = %systemroot%\system32\wbem\wmiprov.dll585700004611686018427387904173Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational10884088WIN-5T344G8GM1HS-1-5-181/16/2018 6:10:25 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2784; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll585700004611686018427387904172Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational27841752WIN-5T344G8GM1HS-1-5-201/16/2018 6:08:29 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Namespace = //./root/CIMV2; NotificationQuery = select * from MSFT_SCMEventLogEvent; OwnerName = S-1-5-32-544; HostProcessID = 1176; Provider= SCM Event Provider, queryID = 0; PossibleCause = Permanent585900004611686018427387904171Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational11763928WIN-5T344G8GM1HS-1-5-181/16/2018 6:08:20 PMb65c0852-8ef4-0003-8709-5cb6f48ed301microsoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Namespace = //./root/subscription; Eventfilter = SCM Event Log Filter (refer to its activate eventid:5859); Consumer = NTEventLogEventConsumer="SCM Event Log Consumer"; PossibleCause = Binding EventFilter: instance of __EventFilter { CreatorSID = {1, 2, 0, 0, 0, 0, 0, 5, 32, 0, 0, 0, 32, 2, 0, 0}; EventNamespace = "root\\cimv2"; Name = "SCM Event Log Filter"; Query = "select * from MSFT_SCMEventLogEvent"; QueryLanguage = "WQL"; }; Perm. Consumer: instance of NTEventLogEventConsumer { Category = 0; CreatorSID = {1, 2, 0, 0, 0, 0, 0, 5, 32, 0, 0, 0, 32, 2, 0, 0}; EventType = 1; Name = "SCM Event Log Consumer"; NameOfUserSIDProperty = "sid"; SourceName = "Service Control Manager"; }; 586100004611686018427387904170Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational11763928WIN-5T344G8GM1HS-1-5-181/16/2018 6:08:20 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
MSVDS__PROVIDER provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2784; ProviderPath = %systemroot%\system32\wbem\vdswmi.dll585700004611686018427387904169Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational27841752WIN-5T344G8GM1HS-1-5-201/16/2018 6:07:37 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32a provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2784; ProviderPath = %systemroot%\system32\wbem\wmipcima.dll585700004611686018427387904168Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational27841752WIN-5T344G8GM1HS-1-5-201/16/2018 6:07:36 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
nettcpip provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2784; ProviderPath = %systemroot%\system32\wbem\NetTCPIP.dll585700004611686018427387904167Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational27844072WIN-5T344G8GM1HS-1-5-201/16/2018 6:07:14 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NetAdapterCim provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4076; ProviderPath = %systemroot%\system32\wbem\NetAdapterCim.dll585700004611686018427387904166Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational40761920WIN-5T344G8GM1HS-1-5-191/16/2018 6:07:14 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2784; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll585700004611686018427387904165Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational27844060WIN-5T344G8GM1HS-1-5-201/16/2018 6:07:14 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2784; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll585700004611686018427387904164Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational27842824WIN-5T344G8GM1HS-1-5-201/16/2018 6:07:14 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 2584; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\Microsoft\Windows\DeviceGuard : SELECT AvailableSecurityProperties FROM Win32_DeviceGuard ; ResultCode = 0x80041032; PossibleCause = Unknown585802004611686018427387904163Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational11762580WIN-5T344G8GM1HS-1-5-181/16/2018 6:06:34 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 2584; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\Microsoft\Windows\DeviceGuard : SELECT RequiredSecurityProperties FROM Win32_DeviceGuard ; ResultCode = 0x80041032; PossibleCause = Unknown585802004611686018427387904162Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational11762580WIN-5T344G8GM1HS-1-5-181/16/2018 6:06:34 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 2584; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\Microsoft\Windows\DeviceGuard : SELECT SecurityServicesConfigured FROM Win32_DeviceGuard ; ResultCode = 0x80041032; PossibleCause = Unknown585802004611686018427387904161Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational11762640WIN-5T344G8GM1HS-1-5-181/16/2018 6:06:34 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Win32_TpmProvider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2784; ProviderPath = C:\Windows\system32\wbem\Win32_TPM.dll585700004611686018427387904160Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational27842824WIN-5T344G8GM1HS-1-5-201/16/2018 6:06:34 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 2584; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\Microsoft\Windows\DeviceGuard : SELECT VirtualizationBasedSecurityStatus FROM Win32_DeviceGuard ; ResultCode = 0x80041032; PossibleCause = Unknown585802004611686018427387904159Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational11762640WIN-5T344G8GM1HS-1-5-181/16/2018 6:06:33 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 2584; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\Microsoft\Windows\DeviceGuard : SELECT SecurityServicesRunning FROM Win32_DeviceGuard ; ResultCode = 0x80041032; PossibleCause = Unknown585802004611686018427387904158Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational11762580WIN-5T344G8GM1HS-1-5-181/16/2018 6:06:33 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 2584; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\Microsoft\Windows\DeviceGuard : SELECT SecurityServicesRunning FROM Win32_DeviceGuard ; ResultCode = 0x80041032; PossibleCause = Unknown585802004611686018427387904157Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational11762580WIN-5T344G8GM1HS-1-5-181/16/2018 6:06:33 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 2584; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\Microsoft\Windows\DeviceGuard : SELECT AvailableSecurityProperties FROM Win32_DeviceGuard ; ResultCode = 0x80041032; PossibleCause = Unknown585802004611686018427387904156Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational11762580WIN-5T344G8GM1HS-1-5-181/16/2018 6:06:33 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 2584; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\Microsoft\Windows\DeviceGuard : SELECT RequiredSecurityProperties FROM Win32_DeviceGuard ; ResultCode = 0x80041032; PossibleCause = Unknown585802004611686018427387904155Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational11762580WIN-5T344G8GM1HS-1-5-181/16/2018 6:06:33 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Win32_DeviceGuard provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2784; ProviderPath = %SystemRoot%\System32\Win32_DeviceGuard.dll585700004611686018427387904154Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational27842824WIN-5T344G8GM1HS-1-5-201/16/2018 6:06:33 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 2584; Component = Unknown; Operation = Start IWbemServices::ExecQuery - ROOT\CIMV2 : select ChassisTypes from Win32_SystemEnclosure; ResultCode = 0x80041032; PossibleCause = Unknown585802004611686018427387904153Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational11762640WIN-5T344G8GM1HS-1-5-181/16/2018 6:06:33 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2784; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll585700004611686018427387904152Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational27842824WIN-5T344G8GM1HS-1-5-201/16/2018 6:06:32 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 2584; Component = Unknown; Operation = Start IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT ID FROM Win32_ServerFeature; ResultCode = 0x80041032; PossibleCause = Unknown585802004611686018427387904151Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational11762640WIN-5T344G8GM1HS-1-5-181/16/2018 6:06:32 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2832; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll585700004611686018427387904150Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational28322860WIN-5T344G8GM1HS-1-5-181/16/2018 6:06:27 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
ServerFeatureProvider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2784; ProviderPath = %windir%\system32\wbem\servercompprov.dll585700004611686018427387904149Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational27842812WIN-5T344G8GM1HS-1-5-201/16/2018 6:06:27 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4892; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll585700004611686018427387904148Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational4892836WIN-5T344G8GM1HS-1-5-201/16/2018 6:02:36 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4256; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll585700004611686018427387904147Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational42564144WIN-5T344G8GM1HS-1-5-181/16/2018 5:53:30 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
nettcpip provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4976; ProviderPath = %systemroot%\system32\wbem\NetTCPIP.dll585700004611686018427387904146Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational49763800WIN-5T344G8GM1HS-1-5-201/16/2018 5:53:24 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NetAdapterCim provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 5092; ProviderPath = %systemroot%\system32\wbem\NetAdapterCim.dll585700004611686018427387904145Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational50922628WIN-5T344G8GM1HS-1-5-191/16/2018 5:53:24 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4976; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll585700004611686018427387904144Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational49763800WIN-5T344G8GM1HS-1-5-201/16/2018 5:53:23 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4976; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll585700004611686018427387904143Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational49765116WIN-5T344G8GM1HS-1-5-201/16/2018 5:53:23 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {53B2B737-8EF1-0000-6DB9-B253F18ED301}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 1152; Component = Unknown; Operation = Start IWbemServices::ExecNotificationQuery - ROOT\CIMV2 : SELECT * FROM Win32_ProcessStartTrace WHERE ProcessName = 'wsmprovhost.exe'; ResultCode = 0x80041032; PossibleCause = Unknown585802004611686018427387904142Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational11524780WIN-5T344G8GM1HS-1-5-181/16/2018 5:50:11 PM53b2b737-8ef1-0000-6db9-b253f18ed301microsoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WMIProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3688; ProviderPath = %systemroot%\system32\wbem\wmiprov.dll585700004611686018427387904141Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational36882160WIN-5T344G8GM1HS-1-5-181/16/2018 5:46:15 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Namespace = ROOT\CIMV2; NotificationQuery = SELECT * FROM Win32_ProcessStartTrace WHERE ProcessName = 'wsmprovhost.exe'; UserName = ; ClientProcessID = 1152, ClientMachine = WIN-5T344G8GM1H; PossibleCause = Temporary586000004611686018427387904140Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational11524676WIN-5T344G8GM1HS-1-5-181/16/2018 5:44:23 PM53b2b737-8ef1-0003-feb9-b253f18ed301microsoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WMI Kernel Trace Event Provider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1152; ProviderPath = C:\Windows\System32\wbem\krnlprov.dll585700004611686018427387904139Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational11524676WIN-5T344G8GM1HS-1-5-181/16/2018 5:44:23 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 400; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_ComputerSystemProduct; ResultCode = 0x80041032; PossibleCause = Unknown585802004611686018427387904138Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational11522600WIN-5T344G8GM1HS-1-5-181/16/2018 5:44:12 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4212; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll585700004611686018427387904137Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational42124236WIN-5T344G8GM1HS-1-5-181/16/2018 5:43:31 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
MSVDS__PROVIDER provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 976; ProviderPath = %systemroot%\system32\wbem\vdswmi.dll585700004611686018427387904136Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9762796WIN-5T344G8GM1HS-1-5-201/16/2018 5:43:29 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
nettcpip provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 976; ProviderPath = %systemroot%\system32\wbem\NetTCPIP.dll585700004611686018427387904135Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9763216WIN-5T344G8GM1HS-1-5-201/16/2018 5:43:23 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NetAdapterCim provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3208; ProviderPath = %systemroot%\system32\wbem\NetAdapterCim.dll585700004611686018427387904134Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational32083308WIN-5T344G8GM1HS-1-5-191/16/2018 5:43:23 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 976; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll585700004611686018427387904133Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational976324WIN-5T344G8GM1HS-1-5-201/16/2018 5:43:23 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32a provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 976; ProviderPath = %systemroot%\system32\wbem\wmipcima.dll585700004611686018427387904132Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational976324WIN-5T344G8GM1HS-1-5-201/16/2018 5:43:17 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 976; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll585700004611686018427387904131Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational976324WIN-5T344G8GM1HS-1-5-201/16/2018 5:43:17 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Namespace = //./root/CIMV2; NotificationQuery = select * from MSFT_SCMEventLogEvent; OwnerName = S-1-5-32-544; HostProcessID = 1152; Provider= SCM Event Provider, queryID = 0; PossibleCause = Permanent585900004611686018427387904130Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational11522720WIN-5T344G8GM1HS-1-5-181/16/2018 5:42:38 PM53b2b737-8ef1-0001-8eb7-b253f18ed301microsoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Namespace = //./root/subscription; Eventfilter = SCM Event Log Filter (refer to its activate eventid:5859); Consumer = NTEventLogEventConsumer="SCM Event Log Consumer"; PossibleCause = Binding EventFilter: instance of __EventFilter { CreatorSID = {1, 2, 0, 0, 0, 0, 0, 5, 32, 0, 0, 0, 32, 2, 0, 0}; EventNamespace = "root\\cimv2"; Name = "SCM Event Log Filter"; Query = "select * from MSFT_SCMEventLogEvent"; QueryLanguage = "WQL"; }; Perm. Consumer: instance of NTEventLogEventConsumer { Category = 0; CreatorSID = {1, 2, 0, 0, 0, 0, 0, 5, 32, 0, 0, 0, 32, 2, 0, 0}; EventType = 1; Name = "SCM Event Log Consumer"; NameOfUserSIDProperty = "sid"; SourceName = "Service Control Manager"; }; 586100004611686018427387904129Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational11522720WIN-5T344G8GM1HS-1-5-181/16/2018 5:42:38 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {A4626349-8EA8-0003-B36D-62A4A88ED301}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::ExecNotificationQuery - ROOT\CIMV2 : SELECT * FROM Win32_ProcessStartTrace WHERE ProcessName = 'wsmprovhost.exe'; ResultCode = 0x80041032; PossibleCause = Unknown585802004611686018427387904128Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9243696WIN-5T344G8GM1HS-1-5-181/16/2018 5:37:24 PMa4626349-8ea8-0003-b36d-62a4a88ed301microsoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 164; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll585700004611686018427387904127Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational1643628WIN-5T344G8GM1HS-1-5-201/16/2018 5:35:48 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WmiPerfInst provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3868; ProviderPath = C:\Windows\System32\wbem\WmiPerfInst.dll585700004611686018427387904126Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational38681388WIN-5T344G8GM1HS-1-5-191/16/2018 5:35:07 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WMIProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4924; ProviderPath = %systemroot%\system32\wbem\wmiprov.dll585700004611686018427387904125Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational4924428WIN-5T344G8GM1HS-1-5-181/16/2018 5:35:04 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WmiPerfClass provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4924; ProviderPath = C:\Windows\System32\wbem\WmiPerfClass.dll585700004611686018427387904124Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational49245928WIN-5T344G8GM1HS-1-5-181/16/2018 5:35:03 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Namespace = ROOT\CIMV2; NotificationQuery = SELECT * FROM Win32_ProcessStartTrace WHERE ProcessName = 'wsmprovhost.exe'; UserName = ; ClientProcessID = 924, ClientMachine = WIN-5T344G8GM1H; PossibleCause = Temporary586000004611686018427387904123Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242052WIN-5T344G8GM1HS-1-5-181/16/2018 5:34:06 PMa4626349-8ea8-0002-ed6e-62a4a88ed301microsoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WMI Kernel Trace Event Provider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 924; ProviderPath = C:\Windows\System32\wbem\krnlprov.dll585700004611686018427387904122Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242052WIN-5T344G8GM1HS-1-5-181/16/2018 5:34:06 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 5028; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll585700004611686018427387904121Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational50285328WIN-5T344G8GM1HS-1-5-181/16/2018 5:32:53 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
nettcpip provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 5804; ProviderPath = %systemroot%\system32\wbem\NetTCPIP.dll585700004611686018427387904120Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational58045824WIN-5T344G8GM1HS-1-5-201/16/2018 5:32:40 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NetAdapterCim provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3816; ProviderPath = %systemroot%\system32\wbem\NetAdapterCim.dll585700004611686018427387904119Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational38161224WIN-5T344G8GM1HS-1-5-191/16/2018 5:32:40 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 5804; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll585700004611686018427387904118Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational58045824WIN-5T344G8GM1HS-1-5-201/16/2018 5:32:40 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 5804; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll585700004611686018427387904117Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5804912WIN-5T344G8GM1HS-1-5-201/16/2018 5:32:40 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3180; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll585700004611686018427387904116Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational3180804WIN-5T344G8GM1HS-1-5-181/16/2018 5:22:47 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
nettcpip provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3772; ProviderPath = %systemroot%\system32\wbem\NetTCPIP.dll585700004611686018427387904115Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational37725300WIN-5T344G8GM1HS-1-5-201/16/2018 5:22:40 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NetAdapterCim provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 888; ProviderPath = %systemroot%\system32\wbem\NetAdapterCim.dll585700004611686018427387904114Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational8885288WIN-5T344G8GM1HS-1-5-191/16/2018 5:22:40 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3772; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll585700004611686018427387904113Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational37725300WIN-5T344G8GM1HS-1-5-201/16/2018 5:22:40 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3772; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll585700004611686018427387904112Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational37723704WIN-5T344G8GM1HS-1-5-201/16/2018 5:22:40 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 5964; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll585700004611686018427387904111Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational59643468WIN-5T344G8GM1HS-1-5-181/16/2018 5:12:54 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {A4626349-8EA8-0000-8A6D-62A4A88ED301}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::ExecNotificationQuery - ROOT\CIMV2 : SELECT * FROM Win32_ProcessStartTrace WHERE ProcessName = 'wsmprovhost.exe'; ResultCode = 0x80041032; PossibleCause = Unknown585802004611686018427387904110Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9241992WIN-5T344G8GM1HS-1-5-181/16/2018 5:12:41 PMa4626349-8ea8-0000-8a6d-62a4a88ed301microsoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
nettcpip provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1260; ProviderPath = %systemroot%\system32\wbem\NetTCPIP.dll585700004611686018427387904109Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational12601960WIN-5T344G8GM1HS-1-5-201/16/2018 5:12:40 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NetAdapterCim provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2736; ProviderPath = %systemroot%\system32\wbem\NetAdapterCim.dll585700004611686018427387904108Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational27362320WIN-5T344G8GM1HS-1-5-191/16/2018 5:12:40 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1260; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll585700004611686018427387904107Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational12601960WIN-5T344G8GM1HS-1-5-201/16/2018 5:12:40 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1260; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll585700004611686018427387904106Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational12601936WIN-5T344G8GM1HS-1-5-201/16/2018 5:12:40 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Namespace = ROOT\CIMV2; NotificationQuery = SELECT * FROM Win32_ProcessStartTrace WHERE ProcessName = 'wsmprovhost.exe'; UserName = ; ClientProcessID = 924, ClientMachine = WIN-5T344G8GM1H; PossibleCause = Temporary586000004611686018427387904105Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9243016WIN-5T344G8GM1HS-1-5-181/16/2018 5:06:17 PMa4626349-8ea8-0003-146c-62a4a88ed301microsoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WMI Kernel Trace Event Provider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 924; ProviderPath = C:\Windows\System32\wbem\krnlprov.dll585700004611686018427387904104Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9243016WIN-5T344G8GM1HS-1-5-181/16/2018 5:06:17 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
MSVDS__PROVIDER provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3428; ProviderPath = %systemroot%\system32\wbem\vdswmi.dll585700004611686018427387904103Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational34285844WIN-5T344G8GM1HS-1-5-201/16/2018 5:06:06 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3428; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll585700004611686018427387904102Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational34285844WIN-5T344G8GM1HS-1-5-201/16/2018 5:06:06 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WMIProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2768; ProviderPath = %systemroot%\system32\wbem\wmiprov.dll585700004611686018427387904101Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational27681104WIN-5T344G8GM1HS-1-5-181/16/2018 5:05:59 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2856; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll585700004611686018427387904100Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational28563704WIN-5T344G8GM1HS-1-5-201/16/2018 5:04:01 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Namespace = //./root/CIMV2; NotificationQuery = select * from MSFT_SCMEventLogEvent; OwnerName = S-1-5-32-544; HostProcessID = 924; Provider= SCM Event Provider, queryID = 0; PossibleCause = Permanent58590000461168601842738790499Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9243356WIN-5T344G8GM1HS-1-5-181/16/2018 5:03:48 PMa4626349-8ea8-0003-c36b-62a4a88ed301microsoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Namespace = //./root/subscription; Eventfilter = SCM Event Log Filter (refer to its activate eventid:5859); Consumer = NTEventLogEventConsumer="SCM Event Log Consumer"; PossibleCause = Binding EventFilter: instance of __EventFilter { CreatorSID = {1, 2, 0, 0, 0, 0, 0, 5, 32, 0, 0, 0, 32, 2, 0, 0}; EventNamespace = "root\\cimv2"; Name = "SCM Event Log Filter"; Query = "select * from MSFT_SCMEventLogEvent"; QueryLanguage = "WQL"; }; Perm. Consumer: instance of NTEventLogEventConsumer { Category = 0; CreatorSID = {1, 2, 0, 0, 0, 0, 0, 5, 32, 0, 0, 0, 32, 2, 0, 0}; EventType = 1; Name = "SCM Event Log Consumer"; NameOfUserSIDProperty = "sid"; SourceName = "Service Control Manager"; }; 58610000461168601842738790498Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9241768WIN-5T344G8GM1HS-1-5-181/16/2018 5:03:48 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
MSVDS__PROVIDER provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2856; ProviderPath = %systemroot%\system32\wbem\vdswmi.dll58570000461168601842738790497Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational28563704WIN-5T344G8GM1HS-1-5-201/16/2018 5:02:51 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
nettcpip provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2856; ProviderPath = %systemroot%\system32\wbem\NetTCPIP.dll58570000461168601842738790496Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational2856812WIN-5T344G8GM1HS-1-5-201/16/2018 5:02:39 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NetAdapterCim provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 5960; ProviderPath = %systemroot%\system32\wbem\NetAdapterCim.dll58570000461168601842738790495Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational59605988WIN-5T344G8GM1HS-1-5-191/16/2018 5:02:39 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2856; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll58570000461168601842738790494Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational28563084WIN-5T344G8GM1HS-1-5-201/16/2018 5:02:39 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 2972; Component = Unknown; Operation = Start IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT ID FROM Win32_ServerFeature; ResultCode = 0x80041032; PossibleCause = Unknown58580200461168601842738790493Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242352WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:13 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{FB2CA36D-0B40-4307-821B-A13B252DE56C}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790492Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242512WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:11 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{F9C77450-3A41-477E-9310-9ACD617BD9E3}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790491Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242512WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:11 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{E62688F0-25FD-4c90-BFF5-F508B9D2E31F}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790490Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242512WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:11 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{E5094040-C46C-4115-B030-04FB2E545B00}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790489Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242512WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:11 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{E4F48E54-F38D-4884-BFB9-D4D2E5729C18}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790488Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242512WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:11 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{E47248BA-94CC-49c4-BBB5-9EB7F05183D0}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790487Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242512WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:11 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{CF7639F3-ABA2-41DB-97F2-81E2C5DBFC5D}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790486Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242512WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:11 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{c6dc5466-785a-11d2-84d0-00c04fb169f7}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790485Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242512WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:11 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{C631DF4C-088F-4156-B058-4375F0853CD8}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790484Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242512WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:11 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{C418DD9D-0D14-4efb-8FBF-CFE535C8FAC7}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790483Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242512WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:11 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{C34B2751-1CF4-44F5-9262-C3FC39666591}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790482Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242512WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:11 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{BC75B1ED-5833-4858-9BB8-CBF0B166DF9D}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790481Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242512WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:11 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{BA649533-0AAC-4E04-B9BC-4DBAE0325B12}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790480Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242512WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:11 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{B087BE9D-ED37-454f-AF9C-04291E351182}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790479Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242512WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:11 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{AADCED64-746C-4633-A97C-D61349046527}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790478Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242512WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:11 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{A3F3E39B-5D83-4940-B954-28315B82F0A8}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790477Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242512WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:11 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{91FBB303-0CD5-4055-BF42-E512A681B325}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790476Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242512WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:11 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{8A28E2C5-8D06-49A4-A08C-632DAA493E17}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790475Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242512WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:11 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{7B849a69-220F-451E-B3FE-2CB811AF94AE}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790474Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242512WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:11 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{7933F41E-56F8-41d6-A31C-4148A711EE93}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790473Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242512WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:11 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{74EE6C03-5363-4554-B161-627540339CAB}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790472Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242512WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:11 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{728EE579-943C-4519-9EF7-AB56765798ED}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790471Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242512WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:11 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{7150F9BF-48AD-4da4-A49C-29EF4A8369BA}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790470Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242512WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:11 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{6232C319-91AC-4931-9385-E70C2B099F0E}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790469Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242512WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:11 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{5794DAFD-BE60-433f-88A2-1A31939AC01F}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790468Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242512WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:11 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{4D2F9B6F-1E52-4711-A382-6A8B1A003DE6}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790467Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242512WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:11 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{4CFB60C1-FAA6-47f1-89AA-0B18730C9FD3}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790466Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242512WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:11 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{4B7C3B0F-E993-4E06-A241-3FBE06943684}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790465Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242512WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:11 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{42B5FAAE-6536-11d2-AE5A-0000F87571E3}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790464Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242512WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:11 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{3A0DBA37-F8B2-4356-83DE-3E90BD5C261F}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790463Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242512WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:11 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{2BFCC077-22D2-48DE-BDE1-2F618D9B476D}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790462Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242512WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:11 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{25537BA6-77A8-11D2-9B6C-0000F8080861}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790461Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242512WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:11 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{1A6364EB-776B-4120-ADE1-B63A406A76B5}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790460Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242512WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:11 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{17D89FEC-5C44-4972-B12D-241CAEF74509}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790459Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242512WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:11 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{169EBF44-942F-4C43-87CE-13C93996EBBE}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790458Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242512WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:11 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{0E28E245-9368-4853-AD84-6DA3BA35BB75}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790457Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242512WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:11 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WMIProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2768; ProviderPath = %systemroot%\system32\wbem\wmiprov.dll58570000461168601842738790456Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational27681124WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:11 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WMIProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2768; ProviderPath = %systemroot%\system32\wbem\wmiprov.dll58570000461168601842738790455Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational27681124WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:11 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{FC491EF1-C4AA-4CE1-B329-414B101DB823}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790454Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242528WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:09 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{fbf687e6-f063-4d9f-9f4f-fd9a26acdd5f}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790453Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242528WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:09 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{FB2CA36D-0B40-4307-821B-A13B252DE56C}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790452Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242528WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:09 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{f3ccc681-b74c-4060-9f26-cd84525dca2a}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790451Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242528WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:09 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{F312195E-3D9D-447A-A3F5-08DFFA24735E}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790450Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242528WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:09 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{E62688F0-25FD-4c90-BFF5-F508B9D2E31F}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790449Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242528WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:09 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{E5094040-C46C-4115-B030-04FB2E545B00}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790448Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242528WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:09 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{E4F48E54-F38D-4884-BFB9-D4D2E5729C18}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790447Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242528WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:09 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{e437bc1c-aa7d-11d2-a382-00c04f991e27}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790446Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242528WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:09 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{CF7639F3-ABA2-41DB-97F2-81E2C5DBFC5D}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790445Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242528WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:09 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{cdeafc3d-948d-49dd-ab12-e578ba4af7aa}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790444Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242528WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:09 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{c6dc5466-785a-11d2-84d0-00c04fb169f7}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790443Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242528WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:09 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{C631DF4C-088F-4156-B058-4375F0853CD8}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790442Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242528WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:09 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{C418DD9D-0D14-4efb-8FBF-CFE535C8FAC7}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790441Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242528WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:09 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{C34B2751-1CF4-44F5-9262-C3FC39666591}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790440Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242528WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:09 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{BC75B1ED-5833-4858-9BB8-CBF0B166DF9D}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790439Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242528WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:09 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{BA649533-0AAC-4E04-B9BC-4DBAE0325B12}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790438Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242528WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:09 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{B587E2B1-4D59-4e7e-AED9-22B9DF11D053}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790437Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242528WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:09 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{B087BE9D-ED37-454f-AF9C-04291E351182}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790436Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242528WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:09 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{AADCED64-746C-4633-A97C-D61349046527}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790435Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242528WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:09 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{A3F3E39B-5D83-4940-B954-28315B82F0A8}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790434Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242528WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:09 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{91FBB303-0CD5-4055-BF42-E512A681B325}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790433Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242528WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:09 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{8A28E2C5-8D06-49A4-A08C-632DAA493E17}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790432Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242528WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:09 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{827D319E-6EAC-11D2-A4EA-00C04F79F83A}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790431Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242528WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:09 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{7B849a69-220F-451E-B3FE-2CB811AF94AE}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790430Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242528WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:09 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{7933F41E-56F8-41d6-A31C-4148A711EE93}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790429Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242528WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:09 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{74EE6C03-5363-4554-B161-627540339CAB}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790428Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242528WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:09 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{728EE579-943C-4519-9EF7-AB56765798ED}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790427Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242528WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:09 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{7150F9BF-48AD-4da4-A49C-29EF4A8369BA}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790426Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242528WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:09 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{6A4C88C6-C502-4f74-8F60-2CB23EDC24E2}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790425Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242528WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:09 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{6232C319-91AC-4931-9385-E70C2B099F0E}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790424Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242528WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:09 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{4CFB60C1-FAA6-47f1-89AA-0B18730C9FD3}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790423Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242528WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:09 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{4bcd6cde-777b-48b6-9804-43568e23545d}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790422Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242528WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:09 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{4B7C3B0F-E993-4E06-A241-3FBE06943684}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790421Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242528WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:09 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{42B5FAAE-6536-11d2-AE5A-0000F87571E3}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790420Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242528WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:09 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{426031c0-0b47-4852-b0ca-ac3d37bfcb39}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790419Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242528WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:09 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{3A0DBA37-F8B2-4356-83DE-3E90BD5C261F}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790418Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242528WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:09 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{3610eda5-77ef-11d2-8dc5-00c04fa31a66}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790417Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242528WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:09 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{2BFCC077-22D2-48DE-BDE1-2F618D9B476D}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790416Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242528WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:09 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{2A8FDC61-2347-4C87-92F6-B05EB91A201A}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790415Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242528WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:09 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{1A6364EB-776B-4120-ADE1-B63A406A76B5}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790414Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242528WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:09 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{17D89FEC-5C44-4972-B12D-241CAEF74509}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790413Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242528WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:09 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{16be69fa-4209-4250-88cb-716cf41954e0}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790412Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242528WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:09 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{169EBF44-942F-4C43-87CE-13C93996EBBE}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790411Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242528WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:09 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{0E28E245-9368-4853-AD84-6DA3BA35BB75}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790410Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242528WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:09 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{0ACDD40C-75AC-47ab-BAA0-BF6DE7E7FE63}"; ResultCode = 0x80041002; PossibleCause = Unknown5858020046116860184273879049Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242528WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:09 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{35378EAC-683F-11D2-A89A-00C04FBBCFA2}"; ResultCode = 0x80041002; PossibleCause = Unknown5858020046116860184273879048Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242528WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:09 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3440; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll5857000046116860184273879047Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational34403468WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:09 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
ServerFeatureProvider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2856; ProviderPath = %windir%\system32\wbem\servercompprov.dll5857000046116860184273879046Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational28563084WIN-5T344G8GM1HS-1-5-201/16/2018 5:02:09 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 2972; Component = Unknown; Operation = Start IWbemServices::ExecQuery - ROOT\CIMV2 : select ChassisTypes from Win32_SystemEnclosure; ResultCode = 0x80041032; PossibleCause = Unknown5858020046116860184273879045Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242484WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:09 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32a provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2856; ProviderPath = %systemroot%\system32\wbem\wmipcima.dll5857000046116860184273879044Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational28563084WIN-5T344G8GM1HS-1-5-201/16/2018 5:02:06 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2856; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll5857000046116860184273879043Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational28562436WIN-5T344G8GM1HS-1-5-201/16/2018 5:02:05 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-PD8DQPRRTAO; User = NT AUTHORITY\SYSTEM; ClientProcessId = 2508; Component = Unknown; Operation = Start IWbemServices::CreateInstanceEnum - root\wmi : MSiSCSI_PortalInfoClass; ResultCode = 0x8004100A; PossibleCause = Unknown5858020046116860184273879042Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9162392WIN-PD8DQPRRTAOS-1-5-181/16/2018 5:01:40 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-PD8DQPRRTAO; User = NT AUTHORITY\SYSTEM; ClientProcessId = 2508; Component = Unknown; Operation = Start IWbemServices::CreateInstanceEnum - root\wmi : MS_SM_AdapterInformationQuery; ResultCode = 0x8004100A; PossibleCause = Unknown5858020046116860184273879041Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9162392WIN-PD8DQPRRTAOS-1-5-181/16/2018 5:01:40 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]