MessageIdVersionQualifiersLevelTaskOpcodeKeywordsRecordIdProviderNameProviderIdLogNameProcessIdThreadIdMachineNameUserIdTimeCreatedActivityIdRelatedActivityIdContainerLogMatchedQueryIdsBookmarkLevelDisplayNameOpcodeDisplayNameTaskDisplayNameKeywordsDisplayNamesProperties
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4600; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll585700004611686018427387904863Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational46004136hv-cinder-82912S-1-5-182/14/2022 9:19:43 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4296; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll585700004611686018427387904862Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational42961848hv-cinder-82912S-1-5-202/14/2022 9:19:43 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {23FB69C2-6A78-4F5B-B6E5-695ACDE6E76B}; ClientMachine = HV-CINDER-82912; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3404; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=801456865; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904861Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5482480hv-cinder-82912S-1-5-182/14/2022 9:19:23 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {DDD06981-8F1B-45A8-8CEB-5A70B0DBA01E}; ClientMachine = HV-CINDER-82912; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3404; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Host.HostName="iqn.2010-10.org.openstack:volume-d11b3a98-fd2d-492e-aac1-cd941f01c0ee"; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904860Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational548984hv-cinder-82912S-1-5-182/14/2022 9:19:21 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {6E762EEE-78F1-4CC8-A899-CDFBA99853E6}; ClientMachine = HV-CINDER-82912; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3404; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_IDMethod.HostName="iqn.2010-10.org.openstack:volume-d11b3a98-fd2d-492e-aac1-cd941f01c0ee",Method=4,Value="iqn.1991-05.com.microsoft:hv-cinder-82912"; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904859Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational548984hv-cinder-82912S-1-5-182/14/2022 9:19:20 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {E26E71BD-45DF-4E1C-A3DD-C8AA11CA7FA7}; ClientMachine = HV-CINDER-82912; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3404; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{4D10C6C6-37EE-4D24-A0E0-782EA61C5FCC}"; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904858Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational548984hv-cinder-82912S-1-5-182/14/2022 9:19:16 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {8E98561B-237F-4D59-8A8D-D10FB02FB9AA}; ClientMachine = HV-CINDER-82912; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3404; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1260601659; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904857Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational548984hv-cinder-82912S-1-5-182/14/2022 9:19:15 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {1F0200AA-79A9-4D06-ADDA-A995A927E200}; ClientMachine = HV-CINDER-82912; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3404; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Host.HostName="iqn.2010-10.org.openstack:volume-5b3a70a5-81f3-41de-a08f-3df4d186a1f0"; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904856Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational548984hv-cinder-82912S-1-5-182/14/2022 9:19:13 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {EC20330D-4BB6-4C81-8481-F8F3320E8B33}; ClientMachine = HV-CINDER-82912; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3404; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_IDMethod.HostName="iqn.2010-10.org.openstack:volume-5b3a70a5-81f3-41de-a08f-3df4d186a1f0",Method=4,Value="iqn.1991-05.com.microsoft:hv-cinder-82912"; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904855Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational548984hv-cinder-82912S-1-5-182/14/2022 9:19:13 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WinTargetProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3348; ProviderPath = C:\windows\system32\wbem\WTWMIProv.dll585700004611686018427387904854Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational33484208hv-cinder-82912S-1-5-192/14/2022 9:19:13 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
StorageWMI provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4296; ProviderPath = %SystemRoot%\System32\storagewmi.dll585700004611686018427387904853Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational42961848hv-cinder-82912S-1-5-202/14/2022 9:19:13 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
StorageWMI provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4296; ProviderPath = %SystemRoot%\System32\storagewmi.dll585700004611686018427387904852Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational42961848hv-cinder-82912S-1-5-202/14/2022 9:17:18 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
MSVSS__PROVIDER provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4296; ProviderPath = %systemroot%\system32\wbem\vsswmi.dll585700004611686018427387904851Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational42961848hv-cinder-82912S-1-5-202/14/2022 9:17:13 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {E9C29B7B-2B6C-42B4-A37F-50249BAD7643}; ClientMachine = HV-CINDER-82912; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3404; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1652602995; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904850Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5482480hv-cinder-82912S-1-5-182/14/2022 9:17:13 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WinTargetProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 5100; ProviderPath = C:\windows\system32\wbem\WTWMIProv.dll585700004611686018427387904849Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational51003344hv-cinder-82912S-1-5-192/14/2022 9:17:09 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {4C18121F-608B-4535-8D40-C8FE172F197C}; ClientMachine = HV-CINDER-82912; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3404; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Host.HostName="iqn.2010-10.org.openstack:volume-d11b3a98-fd2d-492e-aac1-cd941f01c0ee"; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904848Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5482480hv-cinder-82912S-1-5-182/14/2022 9:15:08 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {3FA2AF0B-FAA3-48DE-9176-E3C3C654052E}; ClientMachine = HV-CINDER-82912; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3404; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_IDMethod.HostName="iqn.2010-10.org.openstack:volume-d11b3a98-fd2d-492e-aac1-cd941f01c0ee",Method=4,Value="iqn.1991-05.com.microsoft:hv-cinder-82912"; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904847Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5482480hv-cinder-82912S-1-5-182/14/2022 9:15:08 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WinTargetProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 884; ProviderPath = C:\windows\system32\wbem\WTWMIProv.dll585700004611686018427387904846Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational8843172hv-cinder-82912S-1-5-192/14/2022 9:15:08 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
StorageWMI provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4296; ProviderPath = %SystemRoot%\System32\storagewmi.dll585700004611686018427387904845Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational42961848hv-cinder-82912S-1-5-202/14/2022 9:15:07 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
MSVSS__PROVIDER provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4296; ProviderPath = %systemroot%\system32\wbem\vsswmi.dll585700004611686018427387904844Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational42961848hv-cinder-82912S-1-5-202/14/2022 9:12:44 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {561672B1-26BE-4606-9DD1-0C5D62E90C25}; ClientMachine = HV-CINDER-82912; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3404; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=520469061; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904843Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational548140hv-cinder-82912S-1-5-182/14/2022 9:12:14 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {D27EDC28-F938-415B-BE25-AF8965F391ED}; ClientMachine = HV-CINDER-82912; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3404; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Host.HostName="iqn.2010-10.org.openstack:volume-97cb3f95-c643-4623-906a-845237eeb952"; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904842Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational548140hv-cinder-82912S-1-5-182/14/2022 9:12:14 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {073C0CBA-C179-447F-9DB2-2AC307909D57}; ClientMachine = HV-CINDER-82912; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3404; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_IDMethod.HostName="iqn.2010-10.org.openstack:volume-97cb3f95-c643-4623-906a-845237eeb952",Method=4,Value="iqn.1991-05.com.microsoft:hv-cinder-82912"; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904841Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5484840hv-cinder-82912S-1-5-182/14/2022 9:12:13 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WinTargetProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3876; ProviderPath = C:\windows\system32\wbem\WTWMIProv.dll585700004611686018427387904840Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational38764940hv-cinder-82912S-1-5-192/14/2022 9:12:13 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
StorageWMI provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4296; ProviderPath = %SystemRoot%\System32\storagewmi.dll585700004611686018427387904839Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational42961848hv-cinder-82912S-1-5-202/14/2022 9:12:13 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4296; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll585700004611686018427387904838Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational42961848hv-cinder-82912S-1-5-202/14/2022 9:11:26 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {8C992B27-5A21-4D7A-92DF-CB4E12A0C226}; ClientMachine = HV-CINDER-82912; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3404; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Host.HostName="iqn.2010-10.org.openstack:volume-97cb3f95-c643-4623-906a-845237eeb952"; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904837Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5482480hv-cinder-82912S-1-5-182/14/2022 9:10:47 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {632AF08B-DC09-44A1-9395-06979D07EC7F}; ClientMachine = HV-CINDER-82912; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3404; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_IDMethod.HostName="iqn.2010-10.org.openstack:volume-97cb3f95-c643-4623-906a-845237eeb952",Method=4,Value="iqn.1991-05.com.microsoft:hv-cinder-82912"; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904836Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5483380hv-cinder-82912S-1-5-182/14/2022 9:10:47 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WinTargetProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4328; ProviderPath = C:\windows\system32\wbem\WTWMIProv.dll585700004611686018427387904835Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational43283636hv-cinder-82912S-1-5-192/14/2022 9:10:47 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
StorageWMI provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4296; ProviderPath = %SystemRoot%\System32\storagewmi.dll585700004611686018427387904834Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational42961848hv-cinder-82912S-1-5-202/14/2022 9:10:47 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
StorageWMI provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4296; ProviderPath = %SystemRoot%\System32\storagewmi.dll585700004611686018427387904833Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational42961848hv-cinder-82912S-1-5-202/14/2022 9:08:25 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4296; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll585700004611686018427387904832Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational42961848hv-cinder-82912S-1-5-202/14/2022 9:08:23 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {3510B7ED-945E-42BF-9A26-872A11756A60}; ClientMachine = HV-CINDER-82912; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3404; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=223537035; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904831Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5482480hv-cinder-82912S-1-5-182/14/2022 9:07:50 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {67B8DCAD-84A3-4D96-82FB-7E94BDEA43FE}; ClientMachine = HV-CINDER-82912; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3404; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=2001785842; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904830Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5482480hv-cinder-82912S-1-5-182/14/2022 9:07:49 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {ED6C0E39-7AF2-42BF-BB2A-D1E6E38C64CE}; ClientMachine = HV-CINDER-82912; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3404; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1928071562; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904829Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5482208hv-cinder-82912S-1-5-182/14/2022 9:07:48 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {E2E2E7FB-596B-405F-BB96-14702392E4EC}; ClientMachine = HV-CINDER-82912; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3404; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{1EEF4825-8899-4040-B3CA-C161E1234506}"; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904828Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5482208hv-cinder-82912S-1-5-182/14/2022 9:07:46 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {CBE0FD18-29ED-47A4-9EFA-52013B9CCE71}; ClientMachine = HV-CINDER-82912; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3404; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1147423579; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904827Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5483380hv-cinder-82912S-1-5-182/14/2022 9:07:45 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {E71170C5-4527-4862-B48B-D55FCB90B591}; ClientMachine = HV-CINDER-82912; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3404; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{8837BE41-0180-4B50-A645-C0030C423626}"; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904826Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5482480hv-cinder-82912S-1-5-182/14/2022 9:07:44 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {78FC2B43-F951-44FA-844D-3693E7BD0953}; ClientMachine = HV-CINDER-82912; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3404; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1338377839; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904825Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5482480hv-cinder-82912S-1-5-182/14/2022 9:07:43 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {BFDED53C-EF97-42DB-8CD6-91333773CA16}; ClientMachine = HV-CINDER-82912; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3404; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=289564731; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904824Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5482480hv-cinder-82912S-1-5-182/14/2022 9:07:42 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {ACAD364F-7558-464D-8632-8271C9B34086}; ClientMachine = HV-CINDER-82912; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3404; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1319075069; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904823Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5482480hv-cinder-82912S-1-5-182/14/2022 9:07:36 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {93D79295-9290-4F20-AE34-22E26A222729}; ClientMachine = HV-CINDER-82912; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3404; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=990127154; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904822Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5482480hv-cinder-82912S-1-5-182/14/2022 9:07:35 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
MSVSS__PROVIDER provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4296; ProviderPath = %systemroot%\system32\wbem\vsswmi.dll585700004611686018427387904821Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational42961848hv-cinder-82912S-1-5-202/14/2022 9:07:30 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {36370D08-521E-4D7D-B015-66A5BA9015D0}; ClientMachine = HV-CINDER-82912; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1408; Component = Unknown; Operation = Start IWbemServices::GetObject - root\virtualization\v2 : \\.\ROOT\virtualization\v2:Msvm_VirtualSystemSettingData.InstanceID="Microsoft:5141B890-A4A1-4E97-A1A5-B6903E614B88"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904820Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5482208hv-cinder-82912S-1-5-182/14/2022 9:07:28 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {477B2792-9459-4EA3-8B78-959B07348C40}; ClientMachine = HV-CINDER-82912; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3404; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Host.HostName="iqn.2010-10.org.openstack:volume-7f5f258d-35f1-4817-be11-cc7c958300b4"; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904819Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5482480hv-cinder-82912S-1-5-182/14/2022 9:07:26 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {6531DD45-A517-44D3-9B40-6264AA4260C2}; ClientMachine = HV-CINDER-82912; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3404; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_IDMethod.HostName="iqn.2010-10.org.openstack:volume-7f5f258d-35f1-4817-be11-cc7c958300b4",Method=4,Value="iqn.1991-05.com.microsoft:hv-cinder-82912"; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904818Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5482480hv-cinder-82912S-1-5-182/14/2022 9:07:26 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {C0232432-C72E-4F66-B13F-B8A3905B9CDF}; ClientMachine = HV-CINDER-82912; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3404; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{5AC45AD0-16D2-4572-95CA-12574739E943}"; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904817Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5482480hv-cinder-82912S-1-5-182/14/2022 9:07:24 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {C57F299E-7232-4577-BA11-25AB8AFF4551}; ClientMachine = HV-CINDER-82912; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3404; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{E1D54949-B195-4EBE-9A2E-675D6775AD2C}"; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904816Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5482480hv-cinder-82912S-1-5-182/14/2022 9:07:23 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {C7C4C4FE-5FA7-402B-929F-DEA668266BF4}; ClientMachine = HV-CINDER-82912; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3404; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{7A285A22-A3A5-438B-A1BF-DE6DB5F791AD}"; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904815Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5482208hv-cinder-82912S-1-5-182/14/2022 9:07:22 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {8FB49C21-B4FC-4E72-BC1A-938F68C4A6AB}; ClientMachine = HV-CINDER-82912; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3404; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{8C07F865-92EA-4460-B868-5CE153EBAE98}"; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904814Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5482444hv-cinder-82912S-1-5-182/14/2022 9:06:52 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {4BF09DCA-1738-4EEA-BD2B-DAC0A1C1BC26}; ClientMachine = HV-CINDER-82912; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3404; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Host.HostName="iqn.2010-10.org.openstack:volume-ed36121f-d089-458d-b00e-a1cd40869018"; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904813Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5482208hv-cinder-82912S-1-5-182/14/2022 9:06:44 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {997F423F-AD2C-4654-8AE6-82B2B4B2DAFE}; ClientMachine = HV-CINDER-82912; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3404; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_IDMethod.HostName="iqn.2010-10.org.openstack:volume-ed36121f-d089-458d-b00e-a1cd40869018",Method=4,Value="iqn.1991-05.com.microsoft:hv-cinder-82912"; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904812Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5484728hv-cinder-82912S-1-5-182/14/2022 9:06:44 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {18490E85-DABF-4DEA-95E2-3D67E20A4BFE}; ClientMachine = HV-CINDER-82912; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3404; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{1F061F75-DE0E-47E9-9887-1EC7FDD27DAF}"; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904811Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5482208hv-cinder-82912S-1-5-182/14/2022 9:06:43 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {5109E702-C0D1-4368-B2C7-C19F20E9E58C}; ClientMachine = HV-CINDER-82912; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3404; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=341843001; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904810Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5482996hv-cinder-82912S-1-5-182/14/2022 9:06:42 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {7DA5714B-284B-46AA-A0BB-99D0801A3873}; ClientMachine = HV-CINDER-82912; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3404; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{7077A175-F3F1-4FEB-981F-C196DB4631E3}"; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904809Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational548984hv-cinder-82912S-1-5-182/14/2022 9:06:41 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {C2710482-9A44-4699-9532-6DDFCB2E1FE1}; ClientMachine = HV-CINDER-82912; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3404; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{A3449C34-E58B-492D-9587-679D538D14BB}"; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904808Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5482444hv-cinder-82912S-1-5-182/14/2022 9:06:41 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {25DD76EA-F1D5-4114-86E0-20B9E125A07F}; ClientMachine = HV-CINDER-82912; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3404; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{0B7AD3FF-FC33-4591-82C5-8B38318D5103}"; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904807Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5482208hv-cinder-82912S-1-5-182/14/2022 9:06:40 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {D9984E1D-F63D-4B18-AA71-216F37428EC2}; ClientMachine = HV-CINDER-82912; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3404; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{6A8E4269-71EC-4D3E-8B4B-9B98BE128D47}"; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904806Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5482444hv-cinder-82912S-1-5-182/14/2022 9:06:40 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {11F98DC5-027A-429B-B045-32EB1D762C86}; ClientMachine = HV-CINDER-82912; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3404; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{BBF4CF46-ECE9-491B-A26C-41290076BE05}"; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904805Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5482996hv-cinder-82912S-1-5-182/14/2022 9:06:36 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {5DE7DD2B-9D45-413D-A006-36DE9A78F439}; ClientMachine = HV-CINDER-82912; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3404; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=208241153; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904804Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational548984hv-cinder-82912S-1-5-182/14/2022 9:06:14 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {4AF108A7-44A8-455D-9245-40979AFC81C5}; ClientMachine = HV-CINDER-82912; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3404; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1244569554; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904803Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5482996hv-cinder-82912S-1-5-182/14/2022 9:06:13 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {27D32576-D3F7-41CA-A7E1-B3AF331ABBBF}; ClientMachine = HV-CINDER-82912; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3404; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{79264681-4894-47CD-9045-E0DFF9701CBC}"; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904802Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational548984hv-cinder-82912S-1-5-182/14/2022 9:06:12 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
StorageWMI provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4296; ProviderPath = %SystemRoot%\System32\storagewmi.dll585700004611686018427387904801Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational42961848hv-cinder-82912S-1-5-202/14/2022 9:06:11 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {3EC6810A-6CDD-4072-9994-E05D4C31EB60}; ClientMachine = HV-CINDER-82912; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3404; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=870976245; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904800Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5482208hv-cinder-82912S-1-5-182/14/2022 9:05:37 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {93FC2D59-C95A-4579-A3FE-E677657E4012}; ClientMachine = HV-CINDER-82912; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3404; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1635174683; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904799Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5482208hv-cinder-82912S-1-5-182/14/2022 9:05:30 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {0A7F6FA4-57E3-4ECD-BF50-5A3D20EF07CD}; ClientMachine = HV-CINDER-82912; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3404; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1614131029; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904798Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5482208hv-cinder-82912S-1-5-182/14/2022 9:05:29 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {89DC6B96-C933-4590-BAC2-81E3C3106503}; ClientMachine = HV-CINDER-82912; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3404; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=281036182; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904797Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5482208hv-cinder-82912S-1-5-182/14/2022 9:05:28 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {F7519798-1760-48EC-B496-E7386AA8BBE6}; ClientMachine = HV-CINDER-82912; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3404; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=2081060931; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904796Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5482208hv-cinder-82912S-1-5-182/14/2022 9:05:28 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {B3E17EE5-6FF5-4F7C-9B4C-5CF8B26B69E3}; ClientMachine = HV-CINDER-82912; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3404; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1048247632; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904795Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational548984hv-cinder-82912S-1-5-182/14/2022 9:05:27 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {3CD2A564-B02B-47D0-8521-F75A7B477A38}; ClientMachine = HV-CINDER-82912; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3404; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{9EF9F4D8-B297-4871-88CB-892B864FF7CE}"; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904794Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5482208hv-cinder-82912S-1-5-182/14/2022 9:05:26 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {0261B68E-0817-410E-8F81-686BB4182B21}; ClientMachine = HV-CINDER-82912; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3404; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=644484197; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904793Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational548984hv-cinder-82912S-1-5-182/14/2022 9:05:26 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FA9441B9-4329-46C9-AED0-735D1C8C181E}; ClientMachine = HV-CINDER-82912; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3404; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{786FBA1D-3FFB-4A42-9F9D-CE14AE97178C}"; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904792Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational548984hv-cinder-82912S-1-5-182/14/2022 9:05:20 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {3280DC6C-F381-4ECD-A61B-A74BB30B3564}; ClientMachine = HV-CINDER-82912; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3404; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1911402545; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904791Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational548984hv-cinder-82912S-1-5-182/14/2022 9:05:19 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {34B40C05-C430-47DC-BCA2-27F8C58A78CE}; ClientMachine = HV-CINDER-82912; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3404; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1145357772; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904790Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5482208hv-cinder-82912S-1-5-182/14/2022 9:05:15 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {89190B2D-D223-4AEB-B0B7-FCF5B9C644D9}; ClientMachine = HV-CINDER-82912; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3404; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=746456160; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904789Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5482208hv-cinder-82912S-1-5-182/14/2022 9:05:14 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
MSVSS__PROVIDER provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4296; ProviderPath = %systemroot%\system32\wbem\vsswmi.dll585700004611686018427387904788Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational42961848hv-cinder-82912S-1-5-202/14/2022 9:05:11 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {A40439C0-FA02-448F-B7FE-549A74419CDE}; ClientMachine = HV-CINDER-82912; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1408; Component = Unknown; Operation = Start IWbemServices::GetObject - root\virtualization\v2 : \\.\ROOT\virtualization\v2:Msvm_VirtualSystemSettingData.InstanceID="Microsoft:B57AC580-AC54-4372-9FB1-4FEB2BDE0F1C"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904787Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5484736hv-cinder-82912S-1-5-182/14/2022 9:05:11 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {1878C3FB-5D86-41B4-B0A9-9C99226616E3}; ClientMachine = HV-CINDER-82912; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3404; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=523717575; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904786Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5483220hv-cinder-82912S-1-5-182/14/2022 9:04:54 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {7D6C8CE3-3E6A-46D8-A515-14A3B9D7F3D6}; ClientMachine = HV-CINDER-82912; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3404; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{7B56752B-5AA8-48EC-84D2-B273928BF248}"; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904785Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5482996hv-cinder-82912S-1-5-182/14/2022 9:04:53 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {C861B717-247C-4458-AB86-7DB6BB8542A8}; ClientMachine = HV-CINDER-82912; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3404; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{B625940A-8C14-446F-8F84-06A5228FF2DE}"; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904784Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5482208hv-cinder-82912S-1-5-182/14/2022 9:04:52 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {2228CAA9-77B0-4CAB-8B58-A8F1E83F7CAC}; ClientMachine = HV-CINDER-82912; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3404; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{0745066B-4293-4C1F-9FB9-BC58D831CD42}"; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904783Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5482208hv-cinder-82912S-1-5-182/14/2022 9:04:46 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {44F7A303-BBCE-4BC5-B8A9-E18EC043F3B7}; ClientMachine = HV-CINDER-82912; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3404; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{C4830FC3-B90C-4895-B7B4-FEA156325522}"; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904782Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5484728hv-cinder-82912S-1-5-182/14/2022 9:04:42 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {EFE15E0E-728E-43E2-A3D3-EDAD85FE4206}; ClientMachine = HV-CINDER-82912; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3404; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{0864AD42-FE22-4CA1-96DA-2986B782D2F1}"; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904781Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5484728hv-cinder-82912S-1-5-182/14/2022 9:04:37 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {67402845-AE0B-4B69-9BBF-3B8D328DC743}; ClientMachine = HV-CINDER-82912; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1408; Component = Unknown; Operation = Start IWbemServices::GetObject - root\virtualization\v2 : \\.\ROOT\virtualization\v2:Msvm_VirtualSystemSettingData.InstanceID="Microsoft:C710AE4F-9713-472E-9BE3-A8AB4C43C094"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904780Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5482996hv-cinder-82912S-1-5-182/14/2022 9:04:30 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {428AA9CF-54FB-4A93-9717-6DFADDF7B3B6}; ClientMachine = HV-CINDER-82912; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3404; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1739668522; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904779Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5483380hv-cinder-82912S-1-5-182/14/2022 9:04:27 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {1F0A2A90-CCAC-4C19-9DBA-3F6665D4813D}; ClientMachine = HV-CINDER-82912; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3404; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Host.HostName="iqn.2010-10.org.openstack:volume-5804973b-fcd8-46b0-8636-c3921eab5a97"; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904778Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5482208hv-cinder-82912S-1-5-182/14/2022 9:04:26 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {E8F89A78-E5B0-46BA-AD6E-E17777F24BCD}; ClientMachine = HV-CINDER-82912; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3404; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_IDMethod.HostName="iqn.2010-10.org.openstack:volume-5804973b-fcd8-46b0-8636-c3921eab5a97",Method=4,Value="iqn.1991-05.com.microsoft:hv-cinder-82912"; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904777Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5482208hv-cinder-82912S-1-5-182/14/2022 9:04:26 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {D1624387-4E22-4EB9-A7C2-7403C1B6AB4D}; ClientMachine = HV-CINDER-82912; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3404; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1275541534; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904776Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5484728hv-cinder-82912S-1-5-182/14/2022 9:04:24 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {D4AD3EA9-7412-49C0-9AEB-4917C425B270}; ClientMachine = HV-CINDER-82912; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3404; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1247792767; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904775Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5482996hv-cinder-82912S-1-5-182/14/2022 9:04:23 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {F3ED8842-3816-458F-BB59-BDC3F82F0ED8}; ClientMachine = HV-CINDER-82912; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3404; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{569ED7BB-C78D-4270-8126-CE0B3CDE632D}"; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904774Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5482996hv-cinder-82912S-1-5-182/14/2022 9:04:21 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {E01C3BA2-984E-4605-8197-4FA1CE991F97}; ClientMachine = HV-CINDER-82912; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3404; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=708570359; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904773Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5482208hv-cinder-82912S-1-5-182/14/2022 9:04:21 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
MSVSS__PROVIDER provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4296; ProviderPath = %systemroot%\system32\wbem\vsswmi.dll585700004611686018427387904772Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational42961848hv-cinder-82912S-1-5-202/14/2022 9:04:17 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {D1A34F6A-4A3F-4D48-8361-C598E836AFF5}; ClientMachine = HV-CINDER-82912; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3404; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=295328524; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904771Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5482996hv-cinder-82912S-1-5-182/14/2022 9:04:08 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {4521B8EB-7998-435A-A2D8-D6775A15DEBA}; ClientMachine = HV-CINDER-82912; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3404; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=834454080; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904770Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5483380hv-cinder-82912S-1-5-182/14/2022 9:04:07 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {65BD58E2-C8B4-4406-88B4-6420584A985F}; ClientMachine = HV-CINDER-82912; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3404; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1175712189; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904769Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5483380hv-cinder-82912S-1-5-182/14/2022 9:04:06 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {E272FB4A-DE16-48A1-ADB2-6F965EF46719}; ClientMachine = HV-CINDER-82912; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3404; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Host.HostName="iqn.2010-10.org.openstack:volume-21d48d0f-5efd-4c4d-a52f-7e981dc9410a"; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904768Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5484728hv-cinder-82912S-1-5-182/14/2022 9:03:59 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {E2C296F4-D681-443C-87DF-C1D09195BC3C}; ClientMachine = HV-CINDER-82912; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3404; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_IDMethod.HostName="iqn.2010-10.org.openstack:volume-21d48d0f-5efd-4c4d-a52f-7e981dc9410a",Method=4,Value="iqn.1991-05.com.microsoft:hv-cinder-82912"; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904767Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5484728hv-cinder-82912S-1-5-182/14/2022 9:03:59 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {0F9447B7-307D-4936-A1A3-18F93DF49F35}; ClientMachine = HV-CINDER-82912; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3404; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Host.HostName="iqn.2010-10.org.openstack:volume-05d9123e-e821-48ce-9b78-a7c76d352c69"; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904766Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5483380hv-cinder-82912S-1-5-182/14/2022 9:03:58 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {EFB0C8E1-8B3D-41B7-8149-BD142DC284CB}; ClientMachine = HV-CINDER-82912; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3404; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_IDMethod.HostName="iqn.2010-10.org.openstack:volume-05d9123e-e821-48ce-9b78-a7c76d352c69",Method=4,Value="iqn.1991-05.com.microsoft:hv-cinder-82912"; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904765Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5483380hv-cinder-82912S-1-5-182/14/2022 9:03:57 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {0DEB72A2-3547-419C-A83E-0EE009A964AF}; ClientMachine = HV-CINDER-82912; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3404; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=647766038; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904764Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5484728hv-cinder-82912S-1-5-182/14/2022 9:03:14 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {547CB15E-ACC8-4A75-9A1F-885E5C6A32DC}; ClientMachine = HV-CINDER-82912; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3404; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1132071662; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904763Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5484728hv-cinder-82912S-1-5-182/14/2022 9:03:13 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {E1C47025-B13D-4004-9BA8-E7A9AAD765F5}; ClientMachine = HV-CINDER-82912; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3404; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{C76958F5-044D-4DB3-B6C5-B0CDCCF13898}"; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904762Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5484728hv-cinder-82912S-1-5-182/14/2022 9:03:13 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {6DF8918B-126D-48C6-A2C2-909475DA5A29}; ClientMachine = HV-CINDER-82912; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3404; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1645313029; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904761Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5484840hv-cinder-82912S-1-5-182/14/2022 9:03:12 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {E28B6080-7DAD-4623-93BE-03405FC9321C}; ClientMachine = HV-CINDER-82912; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3404; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1033792568; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904760Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5482996hv-cinder-82912S-1-5-182/14/2022 9:03:06 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {062128BE-C5F3-4F47-8240-9D169BDF310B}; ClientMachine = HV-CINDER-82912; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3404; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{9448387B-2D00-479E-9214-CCD772CE3267}"; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904759Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5484840hv-cinder-82912S-1-5-182/14/2022 9:03:05 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {37BD734C-1B4C-4334-AC7B-50A8D7C7C640}; ClientMachine = HV-CINDER-82912; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3404; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{E328B3DF-96B1-4BD6-9C9F-912AB8EDBDC6}"; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904758Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational548984hv-cinder-82912S-1-5-182/14/2022 9:03:05 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {F06CCE7D-A0F1-4E33-B107-F21C59E4C1FE}; ClientMachine = HV-CINDER-82912; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1408; Component = Unknown; Operation = Start IWbemServices::GetObject - root\virtualization\v2 : \\.\ROOT\virtualization\v2:Msvm_VirtualSystemSettingData.InstanceID="Microsoft:40F16F0E-B6E4-4EFF-BF3A-BA3CC1CA5A43"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904757Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5484840hv-cinder-82912S-1-5-182/14/2022 9:02:56 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {6815B981-12E7-4AFB-8CC3-E31CAE3BAAA1}; ClientMachine = HV-CINDER-82912; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3404; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=390111694; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904756Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5484728hv-cinder-82912S-1-5-182/14/2022 9:02:54 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {3A4995DE-C3E3-4455-95B0-BF5E4936EEA3}; ClientMachine = HV-CINDER-82912; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3404; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=776765605; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904755Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5484728hv-cinder-82912S-1-5-182/14/2022 9:02:53 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {4BF763E5-5931-4992-87E8-15D1DBB85314}; ClientMachine = HV-CINDER-82912; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3404; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=591119409; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904754Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5484284hv-cinder-82912S-1-5-182/14/2022 9:02:51 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {4F7E4C73-5700-4FE0-A8D6-6C405E2E2140}; ClientMachine = HV-CINDER-82912; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3404; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=2008187143; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904753Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5484284hv-cinder-82912S-1-5-182/14/2022 9:02:51 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {F1892AA2-5840-4F39-8A12-401E56AB57BC}; ClientMachine = HV-CINDER-82912; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3404; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1240457118; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904752Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational548984hv-cinder-82912S-1-5-182/14/2022 9:02:34 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {D37A78DF-C3CB-4238-8299-76196B72D77D}; ClientMachine = HV-CINDER-82912; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3404; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1347255827; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904751Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5484728hv-cinder-82912S-1-5-182/14/2022 9:02:33 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {39147431-819A-4B21-9DFE-98BEFF9B4AC1}; ClientMachine = HV-CINDER-82912; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3404; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1243111256; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904750Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5482444hv-cinder-82912S-1-5-182/14/2022 9:02:33 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {86B88AE2-5158-4007-8720-F73360508B3A}; ClientMachine = HV-CINDER-82912; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3404; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1034590057; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904749Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5484284hv-cinder-82912S-1-5-182/14/2022 9:02:32 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {3B0A33F0-DE21-4F82-9ED2-9F70BE4461DB}; ClientMachine = HV-CINDER-82912; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1408; Component = Unknown; Operation = Start IWbemServices::GetObject - root\virtualization\v2 : \\.\ROOT\virtualization\v2:Msvm_VirtualSystemSettingData.InstanceID="Microsoft:110E8178-AD57-4BC7-AEF7-BE76DD03CFC3"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904748Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5484736hv-cinder-82912S-1-5-182/14/2022 9:02:32 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9B4A5913-1C71-4BC8-B0DE-5AD334743134}; ClientMachine = HV-CINDER-82912; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3404; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Host.HostName="iqn.2010-10.org.openstack:volume-53b7260a-7c48-4fce-b699-c34ff53027de"; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904747Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5482444hv-cinder-82912S-1-5-182/14/2022 9:02:29 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {4C478B50-BAD8-4B35-8A6E-563C7FB42294}; ClientMachine = HV-CINDER-82912; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3404; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_IDMethod.HostName="iqn.2010-10.org.openstack:volume-53b7260a-7c48-4fce-b699-c34ff53027de",Method=4,Value="iqn.1991-05.com.microsoft:hv-cinder-82912"; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904746Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5482444hv-cinder-82912S-1-5-182/14/2022 9:02:29 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {4133BB4C-9FB1-4FD2-A252-9BD3AC78C3FE}; ClientMachine = HV-CINDER-82912; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3404; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=394661800; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904745Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational548984hv-cinder-82912S-1-5-182/14/2022 9:02:16 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {D6546D35-D338-461E-9A37-237CA17A3C2E}; ClientMachine = HV-CINDER-82912; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3404; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1748130128; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904744Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5482444hv-cinder-82912S-1-5-182/14/2022 9:02:15 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {2193F920-FF79-4F3E-8E02-12E6B892B3D3}; ClientMachine = HV-CINDER-82912; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3404; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1706639508; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904743Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational548984hv-cinder-82912S-1-5-182/14/2022 9:02:14 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {DC6F6AA4-95FD-4882-83FF-FF68E95228CB}; ClientMachine = HV-CINDER-82912; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3404; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=864342653; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904742Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5482444hv-cinder-82912S-1-5-182/14/2022 9:02:12 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {167E11DE-6A79-4111-A295-BD0E2D3112C0}; ClientMachine = HV-CINDER-82912; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3404; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=61404828; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904741Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5482444hv-cinder-82912S-1-5-182/14/2022 9:02:11 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FE05E4AC-A341-4489-9E2F-825DA43FA80F}; ClientMachine = HV-CINDER-82912; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3404; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{1781464D-0C4A-4150-9551-DEEC1ABD9506}"; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904740Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5483220hv-cinder-82912S-1-5-182/14/2022 9:02:08 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {373E84C1-8E68-4EFA-ACA5-442C5D3AF7F9}; ClientMachine = HV-CINDER-82912; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3404; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=623933146; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904739Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5484728hv-cinder-82912S-1-5-182/14/2022 9:02:08 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {540B5136-7197-40E9-9879-B96124D9D72A}; ClientMachine = HV-CINDER-82912; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3404; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1456797391; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904738Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5484728hv-cinder-82912S-1-5-182/14/2022 9:02:02 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {88553CD3-8D5C-4028-A0F7-34F1978DA676}; ClientMachine = HV-CINDER-82912; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3404; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=949239031; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904737Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5484728hv-cinder-82912S-1-5-182/14/2022 9:02:01 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {D7D9F618-C6A3-48A3-A316-E0AEDE606F73}; ClientMachine = HV-CINDER-82912; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3404; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1874936814; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904736Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5482444hv-cinder-82912S-1-5-182/14/2022 9:02:00 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {8BF9FA41-96D3-44F7-A61F-46B5049E9A6D}; ClientMachine = HV-CINDER-82912; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3404; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{AD9A0B51-ACD9-4CD6-B625-5675EA47C3B3}"; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904735Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5484728hv-cinder-82912S-1-5-182/14/2022 9:01:59 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {1E1F9806-70B1-4C87-B3F8-1720A56911A9}; ClientMachine = HV-CINDER-82912; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3404; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Host.HostName="iqn.2010-10.org.openstack:volume-c21db011-b96d-4047-a55e-c33553883c49"; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904734Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5483220hv-cinder-82912S-1-5-182/14/2022 9:01:59 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {08EDB712-3FA7-43D2-8EBE-F72828726353}; ClientMachine = HV-CINDER-82912; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3404; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_IDMethod.HostName="iqn.2010-10.org.openstack:volume-c21db011-b96d-4047-a55e-c33553883c49",Method=4,Value="iqn.1991-05.com.microsoft:hv-cinder-82912"; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904733Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5482444hv-cinder-82912S-1-5-182/14/2022 9:01:59 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {4ABB8237-9C2F-48C5-9BF2-674B48E5FCB0}; ClientMachine = HV-CINDER-82912; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3404; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1429197091; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904732Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5484284hv-cinder-82912S-1-5-182/14/2022 9:01:51 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {F7A02422-A810-48F8-8C35-B1EB7AEA6523}; ClientMachine = HV-CINDER-82912; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3404; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1540033847; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904731Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5482996hv-cinder-82912S-1-5-182/14/2022 9:01:45 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {50794841-4A06-444C-8165-F9CF035E7DD9}; ClientMachine = HV-CINDER-82912; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3404; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=928147049; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904730Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5484840hv-cinder-82912S-1-5-182/14/2022 9:01:44 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {EC4832C3-93CA-442D-AE56-75AC9F22B4A4}; ClientMachine = HV-CINDER-82912; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3404; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Host.HostName="iqn.2010-10.org.openstack:volume-a75bb45b-26dd-42a9-b436-7ed939a62db3"; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904729Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5483220hv-cinder-82912S-1-5-182/14/2022 9:01:43 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {CEC6F999-9C38-4154-B8F4-D2D0132E16C5}; ClientMachine = HV-CINDER-82912; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3404; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_IDMethod.HostName="iqn.2010-10.org.openstack:volume-a75bb45b-26dd-42a9-b436-7ed939a62db3",Method=4,Value="iqn.1991-05.com.microsoft:hv-cinder-82912"; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904728Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5482208hv-cinder-82912S-1-5-182/14/2022 9:01:43 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {E8EB410E-9BBB-425C-9CBA-B4C64157EDD1}; ClientMachine = HV-CINDER-82912; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3404; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1454133078; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904727Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5483380hv-cinder-82912S-1-5-182/14/2022 9:01:37 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {50A2CC33-214C-45B8-8065-CE6086A134DC}; ClientMachine = HV-CINDER-82912; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1408; Component = Unknown; Operation = Start IWbemServices::GetObject - root\virtualization\v2 : \\.\ROOT\virtualization\v2:Msvm_VirtualSystemSettingData.InstanceID="Microsoft:891AEB51-5DF6-4202-9763-3319009BBD98"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904726Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5482844hv-cinder-82912S-1-5-182/14/2022 9:01:26 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {F69D685D-1521-4ADD-A23C-AC25178168D5}; ClientMachine = HV-CINDER-82912; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3404; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=851985256; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904725Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5482480hv-cinder-82912S-1-5-182/14/2022 9:01:19 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {3D283CB2-404A-450A-9610-E5A41CA72AD4}; ClientMachine = HV-CINDER-82912; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3404; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1204720613; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904724Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5484728hv-cinder-82912S-1-5-182/14/2022 9:01:15 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {DCFBB755-96E8-4A00-A1C3-DCBBE485FE74}; ClientMachine = HV-CINDER-82912; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3404; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=969658349; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904723Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational548528hv-cinder-82912S-1-5-182/14/2022 9:01:13 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {C4E84292-3FEB-4EF1-B7BB-60BD900125FB}; ClientMachine = HV-CINDER-82912; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3404; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{60DCA8FB-E787-4FAC-8BF1-0599DD7EF564}"; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904722Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5482996hv-cinder-82912S-1-5-182/14/2022 9:01:12 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {E8C08D33-320E-446F-999C-3D9AC96BB1C1}; ClientMachine = HV-CINDER-82912; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3404; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Host.HostName="iqn.2010-10.org.openstack:volume-7a59bfe0-3ac1-4217-8768-7bf4c849975c"; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904721Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational548528hv-cinder-82912S-1-5-182/14/2022 9:01:11 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {3264D749-47CB-4FD4-BD3A-1786C2A9FBA3}; ClientMachine = HV-CINDER-82912; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3404; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_IDMethod.HostName="iqn.2010-10.org.openstack:volume-7a59bfe0-3ac1-4217-8768-7bf4c849975c",Method=4,Value="iqn.1991-05.com.microsoft:hv-cinder-82912"; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904720Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5482996hv-cinder-82912S-1-5-182/14/2022 9:01:11 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {996257E9-6B77-4770-A1C8-C0D09239F635}; ClientMachine = HV-CINDER-82912; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3404; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1708595576; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904719Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5483380hv-cinder-82912S-1-5-182/14/2022 9:00:50 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {3C780FDC-29E0-4AC0-882D-882073F80B56}; ClientMachine = HV-CINDER-82912; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3404; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=211131442; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904718Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5482844hv-cinder-82912S-1-5-182/14/2022 9:00:43 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {5A047D1B-53D2-4A79-A3CA-723245246393}; ClientMachine = HV-CINDER-82912; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3404; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=119309727; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904717Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5484728hv-cinder-82912S-1-5-182/14/2022 9:00:40 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {BB62AE45-0712-4498-AA3C-C41570FCE142}; ClientMachine = HV-CINDER-82912; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3404; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Host.HostName="iqn.2010-10.org.openstack:volume-695a6f95-997e-4c85-9833-78635a1ed95e"; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904716Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5484284hv-cinder-82912S-1-5-182/14/2022 9:00:39 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {82F7C0AC-9F78-462E-B71F-826E2B306515}; ClientMachine = HV-CINDER-82912; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3404; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_IDMethod.HostName="iqn.2010-10.org.openstack:volume-695a6f95-997e-4c85-9833-78635a1ed95e",Method=4,Value="iqn.1991-05.com.microsoft:hv-cinder-82912"; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904715Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5484284hv-cinder-82912S-1-5-182/14/2022 9:00:39 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {4F442C68-F8B0-405E-AD3D-72E170DF5409}; ClientMachine = HV-CINDER-82912; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3404; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=401445539; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904714Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational548528hv-cinder-82912S-1-5-182/14/2022 9:00:35 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {553EE56D-6287-4990-B74D-1D00A197FA21}; ClientMachine = HV-CINDER-82912; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3404; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1208269434; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904713Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5484284hv-cinder-82912S-1-5-182/14/2022 9:00:32 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FCC1071C-81C3-48D8-9453-0EF5E95A0270}; ClientMachine = HV-CINDER-82912; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3404; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1426122808; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904712Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5482844hv-cinder-82912S-1-5-182/14/2022 9:00:30 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {3F724A14-8EB8-49AE-8D90-2D37DA511509}; ClientMachine = HV-CINDER-82912; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3404; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=775814932; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904711Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5482844hv-cinder-82912S-1-5-182/14/2022 9:00:28 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {E741AAD4-CFC3-44D5-A81D-730DB60F3455}; ClientMachine = HV-CINDER-82912; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3404; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1975682068; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904710Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5484284hv-cinder-82912S-1-5-182/14/2022 9:00:27 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {D821780B-22CA-4A70-AD03-974D7D11B7CA}; ClientMachine = HV-CINDER-82912; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3404; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1951721267; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904709Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5484840hv-cinder-82912S-1-5-182/14/2022 9:00:27 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {A6953791-1A10-47C7-97E8-5DEB8289A854}; ClientMachine = HV-CINDER-82912; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3404; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1141660163; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904708Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5484840hv-cinder-82912S-1-5-182/14/2022 9:00:24 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {0950D29F-7282-4D43-808A-09E065D1B56A}; ClientMachine = HV-CINDER-82912; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3404; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1162790384; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904707Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational548984hv-cinder-82912S-1-5-182/14/2022 9:00:18 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {3ACD6E17-1B05-4D24-89AD-CA5FE63ADDF6}; ClientMachine = HV-CINDER-82912; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3404; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1323995658; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904706Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational548528hv-cinder-82912S-1-5-182/14/2022 9:00:15 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {6B6DBC09-D715-4ECA-B1FB-49C0AC9DA2C3}; ClientMachine = HV-CINDER-82912; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3404; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{99617D51-3506-4B09-96B4-957E473C821F}"; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904705Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational548140hv-cinder-82912S-1-5-182/14/2022 9:00:14 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {D3BA7744-7DEE-4454-BBD1-3E9E3B67E983}; ClientMachine = HV-CINDER-82912; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3404; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=274305346; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904704Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5484728hv-cinder-82912S-1-5-182/14/2022 9:00:08 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {464B4D30-3C25-474E-B79B-C7EBF8145073}; ClientMachine = HV-CINDER-82912; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3404; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Host.HostName="iqn.2010-10.org.openstack:volume-556c9ad9-6277-420e-95aa-740d98b38daa"; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904703Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational548528hv-cinder-82912S-1-5-182/14/2022 9:00:06 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {A9B77C0F-096E-40E9-ABF7-8A071073C0E1}; ClientMachine = HV-CINDER-82912; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3404; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_IDMethod.HostName="iqn.2010-10.org.openstack:volume-556c9ad9-6277-420e-95aa-740d98b38daa",Method=4,Value="iqn.1991-05.com.microsoft:hv-cinder-82912"; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904702Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational548528hv-cinder-82912S-1-5-182/14/2022 9:00:06 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {EE0D494F-6D0E-4732-9B8A-FFB1A23FC659}; ClientMachine = HV-CINDER-82912; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3404; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1576774968; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904701Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5482996hv-cinder-82912S-1-5-182/14/2022 9:00:02 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {6EF7C79B-78CA-4515-A775-7979E9A97AE9}; ClientMachine = HV-CINDER-82912; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3404; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{5441D551-1E9E-4834-BCD5-A23F2845C2DC}"; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904700Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational548528hv-cinder-82912S-1-5-182/14/2022 9:00:01 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {756805C0-1584-4864-A0BC-38068747DCE8}; ClientMachine = HV-CINDER-82912; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3404; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=229058235; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904699Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5484728hv-cinder-82912S-1-5-182/14/2022 8:59:54 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {E4BEDA44-2F0E-4E29-B812-A78DE432F723}; ClientMachine = HV-CINDER-82912; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3404; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{38379208-680F-4532-9F55-18B3797B2817}"; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904698Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational548528hv-cinder-82912S-1-5-182/14/2022 8:59:52 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {35DB1C30-EFF5-4646-A72D-528D501535DB}; ClientMachine = HV-CINDER-82912; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3404; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1806172496; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904697Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational548984hv-cinder-82912S-1-5-182/14/2022 8:59:47 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {8DC306B1-E462-4D3F-A700-65FB5577E9C3}; ClientMachine = HV-CINDER-82912; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3404; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=910094121; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904696Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5483380hv-cinder-82912S-1-5-182/14/2022 8:59:46 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {3DDEE918-533E-4077-B64D-B7BC2B8F8003}; ClientMachine = HV-CINDER-82912; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3404; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1575778109; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904695Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5483380hv-cinder-82912S-1-5-182/14/2022 8:59:41 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {BB6680C4-4339-47F8-B336-C4BFA70EA924}; ClientMachine = HV-CINDER-82912; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3404; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=305997951; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904694Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5482996hv-cinder-82912S-1-5-182/14/2022 8:59:41 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FEEC8567-A510-425E-9C28-E7DA4C1B899C}; ClientMachine = HV-CINDER-82912; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3404; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1835263964; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904693Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5484728hv-cinder-82912S-1-5-182/14/2022 8:59:39 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {D9B22B04-2730-4B0D-9570-88598194896D}; ClientMachine = HV-CINDER-82912; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3404; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Host.HostName="iqn.2010-10.org.openstack:volume-9b7c21b2-c205-49f5-b375-76702a06005f"; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904692Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational548528hv-cinder-82912S-1-5-182/14/2022 8:59:38 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {595AA12D-3722-4ABB-AC5F-9AAC942AB677}; ClientMachine = HV-CINDER-82912; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3404; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_IDMethod.HostName="iqn.2010-10.org.openstack:volume-9b7c21b2-c205-49f5-b375-76702a06005f",Method=4,Value="iqn.1991-05.com.microsoft:hv-cinder-82912"; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904691Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational548528hv-cinder-82912S-1-5-182/14/2022 8:59:38 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {46338152-9D63-4687-B76A-BD3C5A6A74E7}; ClientMachine = HV-CINDER-82912; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3404; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1839479345; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904690Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5482996hv-cinder-82912S-1-5-182/14/2022 8:59:38 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {C17FA968-8E45-45D0-8FD7-8037264CA348}; ClientMachine = HV-CINDER-82912; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3404; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=2129476916; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904689Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5483380hv-cinder-82912S-1-5-182/14/2022 8:59:38 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {D870AA79-FCE7-4FE0-9506-E81481DEB073}; ClientMachine = HV-CINDER-82912; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3404; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{F0E31D39-626D-4FD0-85F5-AFA4A8C6CF1B}"; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904688Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational548528hv-cinder-82912S-1-5-182/14/2022 8:59:36 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {E0188729-6A24-4532-9480-FD1D5B223730}; ClientMachine = HV-CINDER-82912; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3404; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1682018088; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904687Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational548528hv-cinder-82912S-1-5-182/14/2022 8:59:36 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {E40D944B-B51D-4097-851A-856B30212ADC}; ClientMachine = HV-CINDER-82912; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3404; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1444813852; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904686Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5484284hv-cinder-82912S-1-5-182/14/2022 8:59:30 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {27788DF7-942C-4C6D-8F64-3E2348262121}; ClientMachine = HV-CINDER-82912; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3404; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1929998240; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904685Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5483380hv-cinder-82912S-1-5-182/14/2022 8:59:25 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
StorageWMI provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4296; ProviderPath = %SystemRoot%\System32\storagewmi.dll585700004611686018427387904684Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational42962112hv-cinder-82912S-1-5-202/14/2022 8:59:23 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {67446725-FFD0-4931-8CD2-DE02822143C1}; ClientMachine = HV-CINDER-82912; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3404; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1821659821; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904683Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational548984hv-cinder-82912S-1-5-182/14/2022 8:59:20 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {332A8318-A01F-4B5D-B758-1049D9D994C9}; ClientMachine = HV-CINDER-82912; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3404; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1203069779; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904682Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5484728hv-cinder-82912S-1-5-182/14/2022 8:59:16 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {8B296D0C-8E8E-40AB-B64D-2BB582498A7F}; ClientMachine = HV-CINDER-82912; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3404; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{7EB2E769-9A77-444A-ADB2-A109091261FE}"; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904681Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5484728hv-cinder-82912S-1-5-182/14/2022 8:59:15 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {01BF72AA-B0A8-4A83-963C-12C26B1A8D8A}; ClientMachine = HV-CINDER-82912; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3404; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=625627040; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904680Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5484284hv-cinder-82912S-1-5-182/14/2022 8:59:06 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {EDD93D5D-9B31-4B3B-9301-8869738DD96C}; ClientMachine = HV-CINDER-82912; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3404; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=131978555; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904679Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5484840hv-cinder-82912S-1-5-182/14/2022 8:59:06 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {8C73E933-297A-4E39-8855-54945B45155B}; ClientMachine = HV-CINDER-82912; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3404; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{F708C2DC-B349-4991-BE2C-F72AD0267DE7}"; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904678Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5483380hv-cinder-82912S-1-5-182/14/2022 8:59:05 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {C7973E43-EB5C-4DFF-BF6D-24E3AB6D7821}; ClientMachine = HV-CINDER-82912; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3404; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{BB1A700E-A17F-401B-8CBE-F181072E331A}"; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904677Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational548984hv-cinder-82912S-1-5-182/14/2022 8:59:05 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {46C4D4D0-E92A-4151-90C8-FF176D39DD08}; ClientMachine = HV-CINDER-82912; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3404; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=532941081; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904676Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5484840hv-cinder-82912S-1-5-182/14/2022 8:58:52 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {3E009174-E9A2-4C99-80B2-10B49A4A20B4}; ClientMachine = HV-CINDER-82912; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3404; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=2000795982; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904675Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5484840hv-cinder-82912S-1-5-182/14/2022 8:58:52 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {7884407C-D96B-46A0-B17B-246500B57C4A}; ClientMachine = HV-CINDER-82912; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3404; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=752840049; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904674Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5483380hv-cinder-82912S-1-5-182/14/2022 8:58:43 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {7055B500-C31E-4CE5-B77E-11599D5F7B9A}; ClientMachine = HV-CINDER-82912; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3404; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{BB7A82B4-FB77-4926-9905-587E7A00431F}"; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904673Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5484728hv-cinder-82912S-1-5-182/14/2022 8:58:42 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {480C3570-7E54-45C1-B50D-7533C25DF3BF}; ClientMachine = HV-CINDER-82912; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3404; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1065108421; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904672Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5483220hv-cinder-82912S-1-5-182/14/2022 8:58:40 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {CA494266-35BD-4438-8AF9-CC282FCDC039}; ClientMachine = HV-CINDER-82912; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3404; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=2028986337; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904671Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5484728hv-cinder-82912S-1-5-182/14/2022 8:58:39 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {83C83E3E-834A-430C-9399-3575F3DEC199}; ClientMachine = HV-CINDER-82912; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3404; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1594806314; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904670Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5483220hv-cinder-82912S-1-5-182/14/2022 8:58:39 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {295BBF69-143E-4948-B404-68368D09122C}; ClientMachine = HV-CINDER-82912; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3404; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1415619262; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904669Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5483220hv-cinder-82912S-1-5-182/14/2022 8:58:37 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
MSVSS__PROVIDER provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4296; ProviderPath = %systemroot%\system32\wbem\vsswmi.dll585700004611686018427387904668Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational42962112hv-cinder-82912S-1-5-202/14/2022 8:58:32 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32a provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4296; ProviderPath = %systemroot%\system32\wbem\wmipcima.dll585700004611686018427387904667Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational42962592hv-cinder-82912S-1-5-202/14/2022 8:58:32 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WinTargetProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4744; ProviderPath = C:\windows\system32\wbem\WTWMIProv.dll585700004611686018427387904666Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational47441908hv-cinder-82912S-1-5-192/14/2022 8:58:32 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4296; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll585700004611686018427387904665Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational42962592hv-cinder-82912S-1-5-202/14/2022 8:58:26 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1572; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll585700004611686018427387904664Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational15721732hv-cinder-82912S-1-5-182/14/2022 8:57:05 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4296; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll585700004611686018427387904663Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational42961848hv-cinder-82912S-1-5-202/14/2022 8:57:05 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Namespace = root\virtualization\v2; NotificationQuery = SELECT * FROM __InstanceDeletionEvent WITHIN 2 WHERE TargetInstance ISA 'Msvm_SyntheticEthernetPortSettingData' ; UserName = NT AUTHORITY\SYSTEM; ClientProcessID = 4556, ClientMachine = HV-CINDER-82912; PossibleCause = Temporary586000004611686018427387904662Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5484736hv-cinder-82912S-1-5-182/14/2022 8:56:36 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Namespace = root\virtualization\v2; NotificationQuery = SELECT * FROM __InstanceCreationEvent WITHIN 2 WHERE TargetInstance ISA 'Msvm_SyntheticEthernetPortSettingData' ; UserName = NT AUTHORITY\SYSTEM; ClientProcessID = 4556, ClientMachine = HV-CINDER-82912; PossibleCause = Temporary586000004611686018427387904661Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5484736hv-cinder-82912S-1-5-182/14/2022 8:56:36 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Namespace = root\virtualization\v2; NotificationQuery = SELECT EnabledState, TargetInstance FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA 'Msvm_ComputerSystem' AND TargetInstance.EnabledState != PreviousInstance.EnabledState AND (TargetInstance.EnabledState = '2' OR TargetInstance.EnabledState = '3' OR TargetInstance.EnabledState = '32768' OR TargetInstance.EnabledState = '32769'); UserName = NT AUTHORITY\SYSTEM; ClientProcessID = 1408, ClientMachine = HV-CINDER-82912; PossibleCause = Temporary586000004611686018427387904660Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5484736hv-cinder-82912S-1-5-182/14/2022 8:56:32 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WinTargetProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 5048; ProviderPath = C:\windows\system32\wbem\WTWMIProv.dll585700004611686018427387904659Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational50484504hv-cinder-82912S-1-5-192/14/2022 8:56:31 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WMIProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 696; ProviderPath = %systemroot%\system32\wbem\wmiprov.dll585700004611686018427387904658Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6963648hv-cinder-82912S-1-5-182/14/2022 8:56:30 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Win32_WIN32_TERMINALSERVICE_Prov provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4296; ProviderPath = %SystemRoot%\system32\tscfgwmi.dll585700004611686018427387904657Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational42962592hv-cinder-82912S-1-5-202/14/2022 8:56:17 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1572; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll585700004611686018427387904656Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational15721732hv-cinder-82912S-1-5-182/14/2022 8:56:06 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4296; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll585700004611686018427387904655Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational42962592hv-cinder-82912S-1-5-202/14/2022 8:56:06 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4296; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll585700004611686018427387904654Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational42962592hv-cinder-82912S-1-5-202/14/2022 8:56:04 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WMIProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 820; ProviderPath = %systemroot%\system32\wbem\wmiprov.dll585700004611686018427387904653Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational8201908hv-cinder-82912S-1-5-182/14/2022 8:43:03 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32a provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 5056; ProviderPath = %systemroot%\system32\wbem\wmipcima.dll585700004611686018427387904652Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational50565092hv-cinder-82912S-1-5-202/14/2022 8:42:02 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Win32_WIN32_TERMINALSERVICE_Prov provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 5056; ProviderPath = %SystemRoot%\system32\tscfgwmi.dll585700004611686018427387904651Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational50565116hv-cinder-82912S-1-5-202/14/2022 8:42:01 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 5056; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll585700004611686018427387904650Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational50565092hv-cinder-82912S-1-5-202/14/2022 8:42:01 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
MSIProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3652; ProviderPath = %systemroot%\system32\wbem\msiprov.dll585700004611686018427387904649Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational36523684hv-cinder-82912S-1-5-182/14/2022 8:27:06 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2748; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll585700004611686018427387904648Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational27482780hv-cinder-82912S-1-5-202/14/2022 8:24:46 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {6F9E5324-21E0-0003-1256-9E6FE021D801}; ClientMachine = HV-CINDER-82912; User = HV-CINDER-82912\Admin; ClientProcessId = 1180; Component = Core; Operation = Start IWbemServices::ExecNotificationQuery - root\virtualization\v2 : SELECT * FROM __InstanceDeletionEvent WITHIN 2 WHERE TargetInstance ISA 'Msvm_ConcreteJob'; ResultCode = 0x800706BE; PossibleCause = Could not send status to client585802004611686018427387904647Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5482152hv-cinder-82912S-1-5-182/14/2022 8:24:08 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {6F9E5324-21E0-0003-1256-9E6FE021D801}; ClientMachine = HV-CINDER-82912; User = HV-CINDER-82912\Admin; ClientProcessId = 1180; Component = Unknown; Operation = Start IWbemServices::ExecNotificationQuery - root\virtualization\v2 : SELECT * FROM __InstanceDeletionEvent WITHIN 2 WHERE TargetInstance ISA 'Msvm_ConcreteJob'; ResultCode = 0x80041032; PossibleCause = Unknown585802004611686018427387904646Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5482288hv-cinder-82912S-1-5-182/14/2022 8:24:08 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {6F9E5324-21E0-0003-1256-9E6FE021D801}; ClientMachine = HV-CINDER-82912; User = HV-CINDER-82912\Admin; ClientProcessId = 1180; Component = Unknown; Operation = Start IWbemServices::ExecNotificationQuery - root\virtualization\v2 : SELECT * FROM __InstanceModificationEvent WITHIN 2 WHERE TargetInstance ISA 'Msvm_ConcreteJob'; ResultCode = 0x80041032; PossibleCause = Unknown585802004611686018427387904645Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5482288hv-cinder-82912S-1-5-182/14/2022 8:24:07 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Namespace = root\virtualization\v2; NotificationQuery = SELECT * FROM __InstanceDeletionEvent WITHIN 2 WHERE TargetInstance ISA 'Msvm_ConcreteJob'; UserName = HV-CINDER-82912\Admin; ClientProcessID = 1180, ClientMachine = HV-CINDER-82912; PossibleCause = Temporary586000004611686018427387904644Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5482288hv-cinder-82912S-1-5-182/14/2022 8:24:07 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Namespace = root\virtualization\v2; NotificationQuery = SELECT * FROM __InstanceModificationEvent WITHIN 2 WHERE TargetInstance ISA 'Msvm_ConcreteJob'; UserName = HV-CINDER-82912\Admin; ClientProcessID = 1180, ClientMachine = HV-CINDER-82912; PossibleCause = Temporary586000004611686018427387904643Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5482288hv-cinder-82912S-1-5-182/14/2022 8:24:07 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NetAdapterCim provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1156; ProviderPath = %systemroot%\system32\wbem\NetAdapterCim.dll585700004611686018427387904642Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational11562332hv-cinder-82912S-1-5-192/14/2022 8:24:06 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
nettcpip provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2748; ProviderPath = %systemroot%\system32\wbem\NetTCPIP.dll585700004611686018427387904641Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational27482780hv-cinder-82912S-1-5-202/14/2022 8:24:04 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
MSiSCSITargetProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2252; ProviderPath = C:\windows\system32\wbem\SmIscsiTargetProv.dll585700004611686018427387904640Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational22521372hv-cinder-82912S-1-5-202/14/2022 8:24:02 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WinTargetProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 840; ProviderPath = C:\windows\system32\wbem\WTWMIProv.dll585700004611686018427387904639Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational8402308hv-cinder-82912S-1-5-192/14/2022 8:24:02 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WMIProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3652; ProviderPath = %systemroot%\system32\wbem\wmiprov.dll585700004611686018427387904638Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational36523688hv-cinder-82912S-1-5-182/14/2022 8:24:02 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
MSiSCSITargetProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2252; ProviderPath = C:\windows\system32\wbem\SmIscsiTargetProv.dll585700004611686018427387904637Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational22523668hv-cinder-82912S-1-5-202/14/2022 8:24:02 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Win32_WIN32_TERMINALSERVICE_Prov provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2748; ProviderPath = %SystemRoot%\system32\tscfgwmi.dll585700004611686018427387904636Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational27483832hv-cinder-82912S-1-5-202/14/2022 8:23:49 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
wfascim provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2748; ProviderPath = %systemroot%\system32\wbem\wfascim.dll585700004611686018427387904635Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational27483832hv-cinder-82912S-1-5-202/14/2022 8:23:46 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3180; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll585700004611686018427387904634Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational31802424hv-cinder-82912S-1-5-182/14/2022 8:23:10 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2748; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll585700004611686018427387904633Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational27482780hv-cinder-82912S-1-5-202/14/2022 8:23:10 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = HV-CINDER-82912; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1344; Component = Unknown; Operation = Start IWbemServices::CreateInstanceEnum - root\wmi : MSiSCSI_PortalInfoClass; ResultCode = 0x8004100C; PossibleCause = Unknown585802004611686018427387904632Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5483768hv-cinder-82912S-1-5-182/14/2022 8:22:27 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = HV-CINDER-82912; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1344; Component = Unknown; Operation = Start IWbemServices::CreateInstanceEnum - root\wmi : MS_SM_AdapterInformationQuery; ResultCode = 0x8004100C; PossibleCause = Unknown585802004611686018427387904631Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5483768hv-cinder-82912S-1-5-182/14/2022 8:22:27 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
wmiprov provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3652; ProviderPath = %systemroot%\system32\wbem\wmiprov.dll585700004611686018427387904630Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational36523688hv-cinder-82912S-1-5-182/14/2022 8:22:27 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = HV-CINDER-82912; User = HV-CINDER-82912\cloudbase-init; ClientProcessId = 3404; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\cimv2 : SELECT RemainingWindowsReArmCount, KeyManagementServiceListeningPort, KeyManagementServiceDnsPublishing, KeyManagementServiceLowPriority, ClientMachineId, KeyManagementServiceHostCaching, Version FROM SoftwareLicensingService; ResultCode = 0x80041032; PossibleCause = Unknown585802004611686018427387904629Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5482992hv-cinder-82912S-1-5-182/14/2022 8:22:24 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
SppProvider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2748; ProviderPath = %SystemRoot%\System32\sppwmi.dll585700004611686018427387904628Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational27482780hv-cinder-82912S-1-5-202/14/2022 8:22:23 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = HV-CINDER-82912; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1344; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\Microsoft\Windows\DeviceGuard : SELECT AvailableSecurityProperties FROM Win32_DeviceGuard ; ResultCode = 0x80041032; PossibleCause = Unknown585802004611686018427387904627Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5481956hv-cinder-82912S-1-5-182/14/2022 8:22:06 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = HV-CINDER-82912; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1344; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\Microsoft\Windows\DeviceGuard : SELECT RequiredSecurityProperties FROM Win32_DeviceGuard ; ResultCode = 0x80041032; PossibleCause = Unknown585802004611686018427387904626Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5481956hv-cinder-82912S-1-5-182/14/2022 8:22:06 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = HV-CINDER-82912; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1344; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\Microsoft\Windows\DeviceGuard : SELECT SecurityServicesConfigured FROM Win32_DeviceGuard ; ResultCode = 0x80041032; PossibleCause = Unknown585802004611686018427387904625Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5482168hv-cinder-82912S-1-5-182/14/2022 8:22:06 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Win32_TpmProvider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2748; ProviderPath = C:\Windows\system32\wbem\Win32_TPM.dll585700004611686018427387904624Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational27482780hv-cinder-82912S-1-5-202/14/2022 8:22:06 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = HV-CINDER-82912; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1344; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\Microsoft\Windows\DeviceGuard : SELECT VirtualizationBasedSecurityStatus FROM Win32_DeviceGuard ; ResultCode = 0x80041032; PossibleCause = Unknown585802004611686018427387904623Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5481956hv-cinder-82912S-1-5-182/14/2022 8:22:06 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = HV-CINDER-82912; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1344; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\Microsoft\Windows\DeviceGuard : SELECT SecurityServicesRunning FROM Win32_DeviceGuard ; ResultCode = 0x80041032; PossibleCause = Unknown585802004611686018427387904622Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5482168hv-cinder-82912S-1-5-182/14/2022 8:22:06 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = HV-CINDER-82912; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1344; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\Microsoft\Windows\DeviceGuard : SELECT SecurityServicesRunning FROM Win32_DeviceGuard ; ResultCode = 0x80041032; PossibleCause = Unknown585802004611686018427387904621Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5482168hv-cinder-82912S-1-5-182/14/2022 8:22:06 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = HV-CINDER-82912; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1344; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\Microsoft\Windows\DeviceGuard : SELECT AvailableSecurityProperties FROM Win32_DeviceGuard ; ResultCode = 0x80041032; PossibleCause = Unknown585802004611686018427387904620Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5482168hv-cinder-82912S-1-5-182/14/2022 8:22:06 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = HV-CINDER-82912; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1344; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\Microsoft\Windows\DeviceGuard : SELECT RequiredSecurityProperties FROM Win32_DeviceGuard ; ResultCode = 0x80041032; PossibleCause = Unknown585802004611686018427387904619Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5481956hv-cinder-82912S-1-5-182/14/2022 8:22:06 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = HV-CINDER-82912; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1344; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\Microsoft\Windows\DeviceGuard : SELECT VirtualizationBasedSecurityStatus FROM Win32_DeviceGuard ; ResultCode = 0x80041032; PossibleCause = Unknown585802004611686018427387904618Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5482168hv-cinder-82912S-1-5-182/14/2022 8:22:06 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = HV-CINDER-82912; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1344; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\Microsoft\Windows\DeviceGuard : SELECT SecurityServicesRunning FROM Win32_DeviceGuard ; ResultCode = 0x80041032; PossibleCause = Unknown585802004611686018427387904617Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5481956hv-cinder-82912S-1-5-182/14/2022 8:22:06 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Win32_DeviceGuard provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2748; ProviderPath = %SystemRoot%\System32\Win32_DeviceGuard.dll585700004611686018427387904616Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational27482780hv-cinder-82912S-1-5-202/14/2022 8:22:06 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = HV-CINDER-82912; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1344; Component = Unknown; Operation = Start IWbemServices::ExecQuery - ROOT\CIMV2 : select ChassisTypes from Win32_SystemEnclosure; ResultCode = 0x80041032; PossibleCause = Unknown585802004611686018427387904615Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5481956hv-cinder-82912S-1-5-182/14/2022 8:22:04 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = HV-CINDER-82912; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1344; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\CIMV2 : SELECT SMBIOSAssetTag FROM Win32_SystemEnclosure ; ResultCode = 0x80041032; PossibleCause = Unknown585802004611686018427387904614Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5482168hv-cinder-82912S-1-5-182/14/2022 8:22:04 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = HV-CINDER-82912; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1344; Component = Unknown; Operation = Start IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT ID FROM Win32_ServerFeature; ResultCode = 0x80041032; PossibleCause = Unknown585802004611686018427387904613Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5482168hv-cinder-82912S-1-5-182/14/2022 8:22:02 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3180; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll585700004611686018427387904612Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational31803380hv-cinder-82912S-1-5-182/14/2022 8:21:57 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
ServerFeatureProvider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2748; ProviderPath = %windir%\system32\wbem\servercompprov.dll585700004611686018427387904611Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational27482780hv-cinder-82912S-1-5-202/14/2022 8:21:57 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {456D3985-9047-4F89-B9F7-7E9979BBBFAF}; ClientMachine = HV-CINDER-82912; User = ; ClientProcessId = 548; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{FC491EF1-C4AA-4CE1-B329-414B101DB823}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904610Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5482552hv-cinder-82912S-1-5-182/14/2022 8:21:52 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {456D3985-9047-4F89-B9F7-7E9979BBBFAF}; ClientMachine = HV-CINDER-82912; User = ; ClientProcessId = 548; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{fbf687e6-f063-4d9f-9f4f-fd9a26acdd5f}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904609Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5482552hv-cinder-82912S-1-5-182/14/2022 8:21:52 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {456D3985-9047-4F89-B9F7-7E9979BBBFAF}; ClientMachine = HV-CINDER-82912; User = ; ClientProcessId = 548; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{FB2CA36D-0B40-4307-821B-A13B252DE56C}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904608Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5482552hv-cinder-82912S-1-5-182/14/2022 8:21:52 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {456D3985-9047-4F89-B9F7-7E9979BBBFAF}; ClientMachine = HV-CINDER-82912; User = ; ClientProcessId = 548; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{f3ccc681-b74c-4060-9f26-cd84525dca2a}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904607Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5482552hv-cinder-82912S-1-5-182/14/2022 8:21:52 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {456D3985-9047-4F89-B9F7-7E9979BBBFAF}; ClientMachine = HV-CINDER-82912; User = ; ClientProcessId = 548; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{F312195E-3D9D-447A-A3F5-08DFFA24735E}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904606Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5482552hv-cinder-82912S-1-5-182/14/2022 8:21:52 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {456D3985-9047-4F89-B9F7-7E9979BBBFAF}; ClientMachine = HV-CINDER-82912; User = ; ClientProcessId = 548; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{E62688F0-25FD-4c90-BFF5-F508B9D2E31F}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904605Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5482552hv-cinder-82912S-1-5-182/14/2022 8:21:52 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {456D3985-9047-4F89-B9F7-7E9979BBBFAF}; ClientMachine = HV-CINDER-82912; User = ; ClientProcessId = 548; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{E5094040-C46C-4115-B030-04FB2E545B00}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904604Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5482552hv-cinder-82912S-1-5-182/14/2022 8:21:52 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {456D3985-9047-4F89-B9F7-7E9979BBBFAF}; ClientMachine = HV-CINDER-82912; User = ; ClientProcessId = 548; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{E4F48E54-F38D-4884-BFB9-D4D2E5729C18}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904603Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5482552hv-cinder-82912S-1-5-182/14/2022 8:21:52 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {456D3985-9047-4F89-B9F7-7E9979BBBFAF}; ClientMachine = HV-CINDER-82912; User = ; ClientProcessId = 548; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{e437bc1c-aa7d-11d2-a382-00c04f991e27}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904602Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5482552hv-cinder-82912S-1-5-182/14/2022 8:21:52 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {456D3985-9047-4F89-B9F7-7E9979BBBFAF}; ClientMachine = HV-CINDER-82912; User = ; ClientProcessId = 548; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{CF7639F3-ABA2-41DB-97F2-81E2C5DBFC5D}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904601Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5482552hv-cinder-82912S-1-5-182/14/2022 8:21:52 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {456D3985-9047-4F89-B9F7-7E9979BBBFAF}; ClientMachine = HV-CINDER-82912; User = ; ClientProcessId = 548; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{cdeafc3d-948d-49dd-ab12-e578ba4af7aa}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904600Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5482552hv-cinder-82912S-1-5-182/14/2022 8:21:52 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {456D3985-9047-4F89-B9F7-7E9979BBBFAF}; ClientMachine = HV-CINDER-82912; User = ; ClientProcessId = 548; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{c6dc5466-785a-11d2-84d0-00c04fb169f7}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904599Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5482552hv-cinder-82912S-1-5-182/14/2022 8:21:52 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {456D3985-9047-4F89-B9F7-7E9979BBBFAF}; ClientMachine = HV-CINDER-82912; User = ; ClientProcessId = 548; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{C631DF4C-088F-4156-B058-4375F0853CD8}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904598Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5482552hv-cinder-82912S-1-5-182/14/2022 8:21:52 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {456D3985-9047-4F89-B9F7-7E9979BBBFAF}; ClientMachine = HV-CINDER-82912; User = ; ClientProcessId = 548; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{C418DD9D-0D14-4efb-8FBF-CFE535C8FAC7}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904597Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5482552hv-cinder-82912S-1-5-182/14/2022 8:21:52 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {456D3985-9047-4F89-B9F7-7E9979BBBFAF}; ClientMachine = HV-CINDER-82912; User = ; ClientProcessId = 548; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{C34B2751-1CF4-44F5-9262-C3FC39666591}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904596Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5482552hv-cinder-82912S-1-5-182/14/2022 8:21:52 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {456D3985-9047-4F89-B9F7-7E9979BBBFAF}; ClientMachine = HV-CINDER-82912; User = ; ClientProcessId = 548; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{BC75B1ED-5833-4858-9BB8-CBF0B166DF9D}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904595Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5482552hv-cinder-82912S-1-5-182/14/2022 8:21:52 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {456D3985-9047-4F89-B9F7-7E9979BBBFAF}; ClientMachine = HV-CINDER-82912; User = ; ClientProcessId = 548; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{BA649533-0AAC-4E04-B9BC-4DBAE0325B12}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904594Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5482552hv-cinder-82912S-1-5-182/14/2022 8:21:52 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {456D3985-9047-4F89-B9F7-7E9979BBBFAF}; ClientMachine = HV-CINDER-82912; User = ; ClientProcessId = 548; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{B587E2B1-4D59-4e7e-AED9-22B9DF11D053}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904593Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5482552hv-cinder-82912S-1-5-182/14/2022 8:21:52 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {456D3985-9047-4F89-B9F7-7E9979BBBFAF}; ClientMachine = HV-CINDER-82912; User = ; ClientProcessId = 548; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{B087BE9D-ED37-454f-AF9C-04291E351182}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904592Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5482552hv-cinder-82912S-1-5-182/14/2022 8:21:52 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {456D3985-9047-4F89-B9F7-7E9979BBBFAF}; ClientMachine = HV-CINDER-82912; User = ; ClientProcessId = 548; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{AADCED64-746C-4633-A97C-D61349046527}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904591Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5482552hv-cinder-82912S-1-5-182/14/2022 8:21:52 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {456D3985-9047-4F89-B9F7-7E9979BBBFAF}; ClientMachine = HV-CINDER-82912; User = ; ClientProcessId = 548; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{A3F3E39B-5D83-4940-B954-28315B82F0A8}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904590Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5482552hv-cinder-82912S-1-5-182/14/2022 8:21:52 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {456D3985-9047-4F89-B9F7-7E9979BBBFAF}; ClientMachine = HV-CINDER-82912; User = ; ClientProcessId = 548; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{91FBB303-0CD5-4055-BF42-E512A681B325}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904589Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5482552hv-cinder-82912S-1-5-182/14/2022 8:21:52 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {456D3985-9047-4F89-B9F7-7E9979BBBFAF}; ClientMachine = HV-CINDER-82912; User = ; ClientProcessId = 548; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{8A28E2C5-8D06-49A4-A08C-632DAA493E17}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904588Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5482552hv-cinder-82912S-1-5-182/14/2022 8:21:52 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {456D3985-9047-4F89-B9F7-7E9979BBBFAF}; ClientMachine = HV-CINDER-82912; User = ; ClientProcessId = 548; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{827D319E-6EAC-11D2-A4EA-00C04F79F83A}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904587Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5482552hv-cinder-82912S-1-5-182/14/2022 8:21:52 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {456D3985-9047-4F89-B9F7-7E9979BBBFAF}; ClientMachine = HV-CINDER-82912; User = ; ClientProcessId = 548; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{7B849a69-220F-451E-B3FE-2CB811AF94AE}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904586Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5482552hv-cinder-82912S-1-5-182/14/2022 8:21:52 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {456D3985-9047-4F89-B9F7-7E9979BBBFAF}; ClientMachine = HV-CINDER-82912; User = ; ClientProcessId = 548; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{7933F41E-56F8-41d6-A31C-4148A711EE93}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904585Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5482552hv-cinder-82912S-1-5-182/14/2022 8:21:52 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {456D3985-9047-4F89-B9F7-7E9979BBBFAF}; ClientMachine = HV-CINDER-82912; User = ; ClientProcessId = 548; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{74EE6C03-5363-4554-B161-627540339CAB}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904584Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5482552hv-cinder-82912S-1-5-182/14/2022 8:21:52 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {456D3985-9047-4F89-B9F7-7E9979BBBFAF}; ClientMachine = HV-CINDER-82912; User = ; ClientProcessId = 548; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{728EE579-943C-4519-9EF7-AB56765798ED}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904583Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5482552hv-cinder-82912S-1-5-182/14/2022 8:21:52 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {456D3985-9047-4F89-B9F7-7E9979BBBFAF}; ClientMachine = HV-CINDER-82912; User = ; ClientProcessId = 548; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{7150F9BF-48AD-4da4-A49C-29EF4A8369BA}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904582Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5482552hv-cinder-82912S-1-5-182/14/2022 8:21:52 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {456D3985-9047-4F89-B9F7-7E9979BBBFAF}; ClientMachine = HV-CINDER-82912; User = ; ClientProcessId = 548; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{6A4C88C6-C502-4f74-8F60-2CB23EDC24E2}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904581Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5482552hv-cinder-82912S-1-5-182/14/2022 8:21:52 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {456D3985-9047-4F89-B9F7-7E9979BBBFAF}; ClientMachine = HV-CINDER-82912; User = ; ClientProcessId = 548; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{6232C319-91AC-4931-9385-E70C2B099F0E}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904580Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5482552hv-cinder-82912S-1-5-182/14/2022 8:21:52 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {456D3985-9047-4F89-B9F7-7E9979BBBFAF}; ClientMachine = HV-CINDER-82912; User = ; ClientProcessId = 548; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{4CFB60C1-FAA6-47f1-89AA-0B18730C9FD3}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904579Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5482552hv-cinder-82912S-1-5-182/14/2022 8:21:52 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {456D3985-9047-4F89-B9F7-7E9979BBBFAF}; ClientMachine = HV-CINDER-82912; User = ; ClientProcessId = 548; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{4bcd6cde-777b-48b6-9804-43568e23545d}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904578Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5482552hv-cinder-82912S-1-5-182/14/2022 8:21:52 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {456D3985-9047-4F89-B9F7-7E9979BBBFAF}; ClientMachine = HV-CINDER-82912; User = ; ClientProcessId = 548; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{4B7C3B0F-E993-4E06-A241-3FBE06943684}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904577Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5482552hv-cinder-82912S-1-5-182/14/2022 8:21:52 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {456D3985-9047-4F89-B9F7-7E9979BBBFAF}; ClientMachine = HV-CINDER-82912; User = ; ClientProcessId = 548; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{42B5FAAE-6536-11d2-AE5A-0000F87571E3}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904576Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5482552hv-cinder-82912S-1-5-182/14/2022 8:21:52 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {456D3985-9047-4F89-B9F7-7E9979BBBFAF}; ClientMachine = HV-CINDER-82912; User = ; ClientProcessId = 548; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{426031c0-0b47-4852-b0ca-ac3d37bfcb39}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904575Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5482552hv-cinder-82912S-1-5-182/14/2022 8:21:52 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {456D3985-9047-4F89-B9F7-7E9979BBBFAF}; ClientMachine = HV-CINDER-82912; User = ; ClientProcessId = 548; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{3A0DBA37-F8B2-4356-83DE-3E90BD5C261F}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904574Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5482552hv-cinder-82912S-1-5-182/14/2022 8:21:52 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {456D3985-9047-4F89-B9F7-7E9979BBBFAF}; ClientMachine = HV-CINDER-82912; User = ; ClientProcessId = 548; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{3610eda5-77ef-11d2-8dc5-00c04fa31a66}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904573Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5482552hv-cinder-82912S-1-5-182/14/2022 8:21:52 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {456D3985-9047-4F89-B9F7-7E9979BBBFAF}; ClientMachine = HV-CINDER-82912; User = ; ClientProcessId = 548; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{2BFCC077-22D2-48DE-BDE1-2F618D9B476D}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904572Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5482552hv-cinder-82912S-1-5-182/14/2022 8:21:52 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {456D3985-9047-4F89-B9F7-7E9979BBBFAF}; ClientMachine = HV-CINDER-82912; User = ; ClientProcessId = 548; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{2A8FDC61-2347-4C87-92F6-B05EB91A201A}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904571Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5482552hv-cinder-82912S-1-5-182/14/2022 8:21:52 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {456D3985-9047-4F89-B9F7-7E9979BBBFAF}; ClientMachine = HV-CINDER-82912; User = ; ClientProcessId = 548; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{1A6364EB-776B-4120-ADE1-B63A406A76B5}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904570Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5482552hv-cinder-82912S-1-5-182/14/2022 8:21:52 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {456D3985-9047-4F89-B9F7-7E9979BBBFAF}; ClientMachine = HV-CINDER-82912; User = ; ClientProcessId = 548; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{17D89FEC-5C44-4972-B12D-241CAEF74509}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904569Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5482552hv-cinder-82912S-1-5-182/14/2022 8:21:52 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {456D3985-9047-4F89-B9F7-7E9979BBBFAF}; ClientMachine = HV-CINDER-82912; User = ; ClientProcessId = 548; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{16be69fa-4209-4250-88cb-716cf41954e0}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904568Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5482552hv-cinder-82912S-1-5-182/14/2022 8:21:52 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {456D3985-9047-4F89-B9F7-7E9979BBBFAF}; ClientMachine = HV-CINDER-82912; User = ; ClientProcessId = 548; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{169EBF44-942F-4C43-87CE-13C93996EBBE}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904567Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5482552hv-cinder-82912S-1-5-182/14/2022 8:21:52 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {456D3985-9047-4F89-B9F7-7E9979BBBFAF}; ClientMachine = HV-CINDER-82912; User = ; ClientProcessId = 548; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{0E28E245-9368-4853-AD84-6DA3BA35BB75}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904566Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5482552hv-cinder-82912S-1-5-182/14/2022 8:21:52 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {456D3985-9047-4F89-B9F7-7E9979BBBFAF}; ClientMachine = HV-CINDER-82912; User = ; ClientProcessId = 548; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{0ACDD40C-75AC-47ab-BAA0-BF6DE7E7FE63}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904565Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5482552hv-cinder-82912S-1-5-182/14/2022 8:21:52 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Namespace = //./root/CIMV2; NotificationQuery = select * from MSFT_SCMEventLogEvent; OwnerName = S-1-5-32-544; HostProcessID = 548; Provider= SCM Event Provider, queryID = 0; PossibleCause = Permanent585900004611686018427387904564Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5484032hv-cinder-82912S-1-5-182/14/2022 8:21:50 PM6f9e5324-21e0-0002-6a53-9e6fe021d801microsoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Namespace = root\virtualization\v2; NotificationQuery = SELECT * FROM __ClassOperationEvent; UserName = .\SYSTEM; ClientProcessID = 0, ClientMachine = ; PossibleCause = Temporary586000004611686018427387904563Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5482552hv-cinder-82912S-1-5-182/14/2022 8:21:50 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Namespace = //./root/subscription; Eventfilter = SCM Event Log Filter (refer to its activate eventid:5859); Consumer = NTEventLogEventConsumer="SCM Event Log Consumer"; PossibleCause = Binding EventFilter: instance of __EventFilter { CreatorSID = {1, 2, 0, 0, 0, 0, 0, 5, 32, 0, 0, 0, 32, 2, 0, 0}; EventNamespace = "root\\cimv2"; Name = "SCM Event Log Filter"; Query = "select * from MSFT_SCMEventLogEvent"; QueryLanguage = "WQL"; }; Perm. Consumer: instance of NTEventLogEventConsumer { Category = 0; CreatorSID = {1, 2, 0, 0, 0, 0, 0, 5, 32, 0, 0, 0, 32, 2, 0, 0}; EventType = 1; Name = "SCM Event Log Consumer"; NameOfUserSIDProperty = "sid"; SourceName = "Service Control Manager"; }; 586100004611686018427387904562Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5484028hv-cinder-82912S-1-5-182/14/2022 8:21:50 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32a provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2748; ProviderPath = %systemroot%\system32\wbem\wmipcima.dll585700004611686018427387904561Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational27482780hv-cinder-82912S-1-5-202/14/2022 8:21:49 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WMIProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3652; ProviderPath = %systemroot%\system32\wbem\wmiprov.dll585700004611686018427387904560Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational36523688hv-cinder-82912S-1-5-182/14/2022 8:21:49 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WMIProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3652; ProviderPath = %systemroot%\system32\wbem\wmiprov.dll585700004611686018427387904559Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational36523688hv-cinder-82912S-1-5-182/14/2022 8:21:49 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = HV-CINDER-82912; User = NT AUTHORITY\SYSTEM; ClientProcessId = 2524; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\virtualization\v2 : Msvm_ResourcePoolComponent.Name="Microsoft|RDV Integration Component Resource Pool|V2.0"; ResultCode = 0x80041010; PossibleCause = Unknown585802004611686018427387904558Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5482552hv-cinder-82912S-1-5-182/14/2022 8:21:44 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2748; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll585700004611686018427387904557Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational27482776hv-cinder-82912S-1-5-202/14/2022 8:21:43 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = HV-CINDER-82912; User = NT AUTHORITY\SYSTEM; ClientProcessId = 2080; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User : __Namespace.name="S_1_5_21_2931605342_3649780983_840737790_500"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904556Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5482636hv-cinder-82912S-1-5-182/14/2022 8:21:43 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-DSA0AJF714B; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3016; Component = Unknown; Operation = Start IWbemServices::CreateInstanceEnum - root\wmi : MSiSCSI_PortalInfoClass; ResultCode = 0x8004100A; PossibleCause = Unknown585802004611686018427387904555Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5242844WIN-5T344G8GM1HS-1-5-182/14/2022 8:21:14 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-DSA0AJF714B; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3016; Component = Unknown; Operation = Start IWbemServices::CreateInstanceEnum - root\wmi : MS_SM_AdapterInformationQuery; ResultCode = 0x8004100A; PossibleCause = Unknown585802004611686018427387904554Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5242844WIN-5T344G8GM1HS-1-5-182/14/2022 8:21:14 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-DSA0AJF714B; User = NT AUTHORITY\SYSTEM; ClientProcessId = 2176; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\virtualization\v2 : Msvm_ResourcePoolComponent.Name="Microsoft|RDV Integration Component Resource Pool|V2.0"; ResultCode = 0x80041010; PossibleCause = Unknown585802004611686018427387904553Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5242080WIN-5T344G8GM1HS-1-5-182/14/2022 8:20:21 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-DSA0AJF714B; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1720; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\cimv2 : select * from Win32_OperatingSystem; ResultCode = 0x8004100A; PossibleCause = Unknown585802004611686018427387904552Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5242080WIN-5T344G8GM1HS-1-5-182/14/2022 8:20:20 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4848; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\wmi : select * from WDMClassesOfDriver where ClassName = "RNDISMPStatisticsOID"; ResultCode = 0x80041032; PossibleCause = Unknown585802004611686018427387904551Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9763432WIN-5T344G8GM1HS-1-5-181/19/2018 9:48:09 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4848; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\wmi : select * from WMIBinaryMofResource where Name = "C:\\windows\\System32\\drivers\\en-US\\netvsc.sys.mui[NdisMofResource]"; ResultCode = 0x80041032; PossibleCause = Unknown585802004611686018427387904550Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9763432WIN-5T344G8GM1HS-1-5-181/19/2018 9:48:09 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
MSVDS__PROVIDER provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4460; ProviderPath = %systemroot%\system32\wbem\vdswmi.dll585700004611686018427387904549Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational44605048WIN-5T344G8GM1HS-1-5-201/19/2018 9:46:31 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4460; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll585700004611686018427387904548Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational44605048WIN-5T344G8GM1HS-1-5-201/19/2018 9:46:31 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WMIProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4848; ProviderPath = %systemroot%\system32\wbem\wmiprov.dll585700004611686018427387904547Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational48484776WIN-5T344G8GM1HS-1-5-181/19/2018 9:45:30 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = WIN-5T344G8GM1H\Administrator; ClientProcessId = 4956; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\Microsoft\Windows\Defender : SELECT * FROM MSFT_MpComputerStatus; ResultCode = 0x80041032; PossibleCause = Unknown585802004611686018427387904546Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9761176WIN-5T344G8GM1HS-1-5-181/19/2018 9:42:52 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
ProtectionManagement provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3752; ProviderPath = "%ProgramData%\Microsoft\Windows Defender\Platform\4.12.17007.18011-0\ProtectionManagement.dll"585700004611686018427387904545Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational37522228WIN-5T344G8GM1HS-1-5-191/19/2018 9:42:52 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
MsNetImPlatform provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2776; ProviderPath = %systemroot%\system32\wbem\ndisimplatcim.dll585700004611686018427387904544Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational27763064WIN-5T344G8GM1HS-1-5-201/19/2018 9:42:52 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4120; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll585700004611686018427387904543Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational41204148WIN-5T344G8GM1HS-1-5-181/19/2018 9:42:50 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
nettcpip provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2776; ProviderPath = %systemroot%\system32\wbem\NetTCPIP.dll585700004611686018427387904542Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational27761292WIN-5T344G8GM1HS-1-5-201/19/2018 9:42:48 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NetAdapterCim provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3752; ProviderPath = %systemroot%\system32\wbem\NetAdapterCim.dll585700004611686018427387904541Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational37522228WIN-5T344G8GM1HS-1-5-191/19/2018 9:42:48 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2776; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll585700004611686018427387904540Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational27763064WIN-5T344G8GM1HS-1-5-201/19/2018 9:42:48 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
MSVDS__PROVIDER provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2776; ProviderPath = %systemroot%\system32\wbem\vdswmi.dll585700004611686018427387904539Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational27763064WIN-5T344G8GM1HS-1-5-201/19/2018 9:42:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32a provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2776; ProviderPath = %systemroot%\system32\wbem\wmipcima.dll585700004611686018427387904538Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational27763064WIN-5T344G8GM1HS-1-5-201/19/2018 9:42:16 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4120; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll585700004611686018427387904537Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational41204148WIN-5T344G8GM1HS-1-5-181/19/2018 9:41:43 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
nettcpip provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2776; ProviderPath = %systemroot%\system32\wbem\NetTCPIP.dll585700004611686018427387904536Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational27761292WIN-5T344G8GM1HS-1-5-201/19/2018 9:41:39 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NetAdapterCim provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3752; ProviderPath = %systemroot%\system32\wbem\NetAdapterCim.dll585700004611686018427387904535Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational37522228WIN-5T344G8GM1HS-1-5-191/19/2018 9:41:39 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2776; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll585700004611686018427387904534Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational27762812WIN-5T344G8GM1HS-1-5-201/19/2018 9:41:39 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Namespace = //./root/CIMV2; NotificationQuery = select * from MSFT_SCMEventLogEvent; OwnerName = S-1-5-32-544; HostProcessID = 976; Provider= SCM Event Provider, queryID = 0; PossibleCause = Permanent585900004611686018427387904533Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9762172WIN-5T344G8GM1HS-1-5-181/19/2018 9:41:32 AMad8d0f9c-9109-0001-0a10-8dad0991d301microsoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Namespace = root\virtualization\v2; NotificationQuery = SELECT * FROM __ClassOperationEvent; UserName = .\SYSTEM; ClientProcessID = 0, ClientMachine = ; PossibleCause = Temporary586000004611686018427387904532Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9762680WIN-5T344G8GM1HS-1-5-181/19/2018 9:41:32 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Namespace = //./root/subscription; Eventfilter = SCM Event Log Filter (refer to its activate eventid:5859); Consumer = NTEventLogEventConsumer="SCM Event Log Consumer"; PossibleCause = Binding EventFilter: instance of __EventFilter { CreatorSID = {1, 2, 0, 0, 0, 0, 0, 5, 32, 0, 0, 0, 32, 2, 0, 0}; EventNamespace = "root\\cimv2"; Name = "SCM Event Log Filter"; Query = "select * from MSFT_SCMEventLogEvent"; QueryLanguage = "WQL"; }; Perm. Consumer: instance of NTEventLogEventConsumer { Category = 0; CreatorSID = {1, 2, 0, 0, 0, 0, 0, 5, 32, 0, 0, 0, 32, 2, 0, 0}; EventType = 1; Name = "SCM Event Log Consumer"; NameOfUserSIDProperty = "sid"; SourceName = "Service Control Manager"; }; 586100004611686018427387904531Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational976388WIN-5T344G8GM1HS-1-5-181/19/2018 9:41:32 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{FC491EF1-C4AA-4CE1-B329-414B101DB823}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904530Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9762680WIN-5T344G8GM1HS-1-5-181/19/2018 9:41:32 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{fbf687e6-f063-4d9f-9f4f-fd9a26acdd5f}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904529Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9762680WIN-5T344G8GM1HS-1-5-181/19/2018 9:41:32 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{FB2CA36D-0B40-4307-821B-A13B252DE56C}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904528Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9762680WIN-5T344G8GM1HS-1-5-181/19/2018 9:41:32 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{f3ccc681-b74c-4060-9f26-cd84525dca2a}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904527Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9762680WIN-5T344G8GM1HS-1-5-181/19/2018 9:41:32 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{F312195E-3D9D-447A-A3F5-08DFFA24735E}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904526Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9762680WIN-5T344G8GM1HS-1-5-181/19/2018 9:41:32 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{E62688F0-25FD-4c90-BFF5-F508B9D2E31F}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904525Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9762680WIN-5T344G8GM1HS-1-5-181/19/2018 9:41:32 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{E5094040-C46C-4115-B030-04FB2E545B00}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904524Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9762680WIN-5T344G8GM1HS-1-5-181/19/2018 9:41:32 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{E4F48E54-F38D-4884-BFB9-D4D2E5729C18}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904523Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9762680WIN-5T344G8GM1HS-1-5-181/19/2018 9:41:32 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{e437bc1c-aa7d-11d2-a382-00c04f991e27}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904522Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9762680WIN-5T344G8GM1HS-1-5-181/19/2018 9:41:32 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{CF7639F3-ABA2-41DB-97F2-81E2C5DBFC5D}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904521Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9762680WIN-5T344G8GM1HS-1-5-181/19/2018 9:41:32 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{cdeafc3d-948d-49dd-ab12-e578ba4af7aa}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904520Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9762680WIN-5T344G8GM1HS-1-5-181/19/2018 9:41:32 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{c6dc5466-785a-11d2-84d0-00c04fb169f7}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904519Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9762680WIN-5T344G8GM1HS-1-5-181/19/2018 9:41:32 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{C631DF4C-088F-4156-B058-4375F0853CD8}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904518Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9762680WIN-5T344G8GM1HS-1-5-181/19/2018 9:41:32 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{C418DD9D-0D14-4efb-8FBF-CFE535C8FAC7}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904517Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9762680WIN-5T344G8GM1HS-1-5-181/19/2018 9:41:32 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{C34B2751-1CF4-44F5-9262-C3FC39666591}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904516Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9762680WIN-5T344G8GM1HS-1-5-181/19/2018 9:41:32 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{BC75B1ED-5833-4858-9BB8-CBF0B166DF9D}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904515Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9762680WIN-5T344G8GM1HS-1-5-181/19/2018 9:41:32 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{BA649533-0AAC-4E04-B9BC-4DBAE0325B12}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904514Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9762680WIN-5T344G8GM1HS-1-5-181/19/2018 9:41:32 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{B587E2B1-4D59-4e7e-AED9-22B9DF11D053}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904513Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9762680WIN-5T344G8GM1HS-1-5-181/19/2018 9:41:32 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{B087BE9D-ED37-454f-AF9C-04291E351182}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904512Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9762680WIN-5T344G8GM1HS-1-5-181/19/2018 9:41:32 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{AADCED64-746C-4633-A97C-D61349046527}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904511Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9762680WIN-5T344G8GM1HS-1-5-181/19/2018 9:41:32 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{A3F3E39B-5D83-4940-B954-28315B82F0A8}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904510Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9762680WIN-5T344G8GM1HS-1-5-181/19/2018 9:41:32 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{91FBB303-0CD5-4055-BF42-E512A681B325}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904509Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9762680WIN-5T344G8GM1HS-1-5-181/19/2018 9:41:32 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{8A28E2C5-8D06-49A4-A08C-632DAA493E17}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904508Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9762680WIN-5T344G8GM1HS-1-5-181/19/2018 9:41:32 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{827D319E-6EAC-11D2-A4EA-00C04F79F83A}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904507Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9762680WIN-5T344G8GM1HS-1-5-181/19/2018 9:41:32 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{7B849a69-220F-451E-B3FE-2CB811AF94AE}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904506Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9762680WIN-5T344G8GM1HS-1-5-181/19/2018 9:41:32 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{7933F41E-56F8-41d6-A31C-4148A711EE93}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904505Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9762680WIN-5T344G8GM1HS-1-5-181/19/2018 9:41:32 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{74EE6C03-5363-4554-B161-627540339CAB}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904504Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9762680WIN-5T344G8GM1HS-1-5-181/19/2018 9:41:32 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{728EE579-943C-4519-9EF7-AB56765798ED}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904503Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9762680WIN-5T344G8GM1HS-1-5-181/19/2018 9:41:32 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{7150F9BF-48AD-4da4-A49C-29EF4A8369BA}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904502Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9762680WIN-5T344G8GM1HS-1-5-181/19/2018 9:41:32 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{6A4C88C6-C502-4f74-8F60-2CB23EDC24E2}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904501Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9762680WIN-5T344G8GM1HS-1-5-181/19/2018 9:41:32 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{6232C319-91AC-4931-9385-E70C2B099F0E}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904500Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9762680WIN-5T344G8GM1HS-1-5-181/19/2018 9:41:32 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{4CFB60C1-FAA6-47f1-89AA-0B18730C9FD3}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904499Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9762680WIN-5T344G8GM1HS-1-5-181/19/2018 9:41:32 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{4bcd6cde-777b-48b6-9804-43568e23545d}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904498Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9762680WIN-5T344G8GM1HS-1-5-181/19/2018 9:41:32 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{4B7C3B0F-E993-4E06-A241-3FBE06943684}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904497Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9762680WIN-5T344G8GM1HS-1-5-181/19/2018 9:41:32 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{42B5FAAE-6536-11d2-AE5A-0000F87571E3}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904496Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9762680WIN-5T344G8GM1HS-1-5-181/19/2018 9:41:32 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{426031c0-0b47-4852-b0ca-ac3d37bfcb39}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904495Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9762680WIN-5T344G8GM1HS-1-5-181/19/2018 9:41:32 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{3A0DBA37-F8B2-4356-83DE-3E90BD5C261F}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904494Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9762680WIN-5T344G8GM1HS-1-5-181/19/2018 9:41:32 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{3610eda5-77ef-11d2-8dc5-00c04fa31a66}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904493Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9762680WIN-5T344G8GM1HS-1-5-181/19/2018 9:41:32 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{2BFCC077-22D2-48DE-BDE1-2F618D9B476D}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904492Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9762680WIN-5T344G8GM1HS-1-5-181/19/2018 9:41:32 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{2A8FDC61-2347-4C87-92F6-B05EB91A201A}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904491Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9762680WIN-5T344G8GM1HS-1-5-181/19/2018 9:41:32 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{1A6364EB-776B-4120-ADE1-B63A406A76B5}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904490Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9762680WIN-5T344G8GM1HS-1-5-181/19/2018 9:41:32 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{17D89FEC-5C44-4972-B12D-241CAEF74509}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904489Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9762680WIN-5T344G8GM1HS-1-5-181/19/2018 9:41:32 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{16be69fa-4209-4250-88cb-716cf41954e0}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904488Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9762680WIN-5T344G8GM1HS-1-5-181/19/2018 9:41:32 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{169EBF44-942F-4C43-87CE-13C93996EBBE}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904487Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9762680WIN-5T344G8GM1HS-1-5-181/19/2018 9:41:32 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{0E28E245-9368-4853-AD84-6DA3BA35BB75}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904486Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9762680WIN-5T344G8GM1HS-1-5-181/19/2018 9:41:32 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{0ACDD40C-75AC-47ab-BAA0-BF6DE7E7FE63}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904485Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9762680WIN-5T344G8GM1HS-1-5-181/19/2018 9:41:32 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2776; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll585700004611686018427387904484Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational27762848WIN-5T344G8GM1HS-1-5-201/19/2018 9:41:31 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 2204; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\virtualization\v2 : Msvm_ResourcePoolComponent.Name="Microsoft|RDV Integration Component Resource Pool|V2.0"; ResultCode = 0x80041010; PossibleCause = Unknown585802004611686018427387904483Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9762692WIN-5T344G8GM1HS-1-5-181/19/2018 9:41:30 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3176; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll585700004611686018427387904482Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational31761548WIN-5T344G8GM1HS-1-5-201/19/2018 9:40:26 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3952; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\interop\ms_409 : MSFTSM_RegisteredSubprofile; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904481Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9564728WIN-5T344G8GM1HS-1-5-181/19/2018 9:38:50 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3952; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\interop\ms_409 : MSFTSM_SubProfileRequiresProfile; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904480Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9564728WIN-5T344G8GM1HS-1-5-181/19/2018 9:38:50 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3952; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\interop\ms_409 : MSFTSM_RegisteredProfile; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904479Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9564728WIN-5T344G8GM1HS-1-5-181/19/2018 9:38:50 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3952; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\interop\ms_409 : MSFTSM_ReferencedProfile; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904478Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9564728WIN-5T344G8GM1HS-1-5-181/19/2018 9:38:50 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3952; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\interop\ms_409 : MSFTSM_ElementSoftwareIdentity; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904477Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9564728WIN-5T344G8GM1HS-1-5-181/19/2018 9:38:50 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3952; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\interop\ms_409 : MSFTSM_ElementConformsToProfileEx; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904476Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9564728WIN-5T344G8GM1HS-1-5-181/19/2018 9:38:50 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3952; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\interop\ms_409 : MSFTSM_ElementConformsToProfile; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904475Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9564728WIN-5T344G8GM1HS-1-5-181/19/2018 9:38:50 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3952; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\cimv2\storage\ms_409 : __Namespace.Name='iscsitarget'; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904474Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9564728WIN-5T344G8GM1HS-1-5-181/19/2018 9:38:50 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WMIProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3968; ProviderPath = %systemroot%\system32\wbem\wmiprov.dll585700004611686018427387904473Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational39684084WIN-5T344G8GM1HS-1-5-181/19/2018 9:38:50 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
MSVDS__PROVIDER provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2712; ProviderPath = %systemroot%\system32\wbem\vdswmi.dll585700004611686018427387904472Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational2712592WIN-5T344G8GM1HS-1-5-201/19/2018 9:38:50 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2712; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll585700004611686018427387904471Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational2712592WIN-5T344G8GM1HS-1-5-201/19/2018 9:38:49 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
nettcpip provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4348; ProviderPath = %systemroot%\system32\wbem\NetTCPIP.dll585700004611686018427387904470Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational43482924WIN-5T344G8GM1HS-1-5-201/19/2018 9:35:55 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NetAdapterCim provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4444; ProviderPath = %systemroot%\system32\wbem\NetAdapterCim.dll585700004611686018427387904469Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational44444516WIN-5T344G8GM1HS-1-5-191/19/2018 9:35:55 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4348; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll585700004611686018427387904468Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational43484632WIN-5T344G8GM1HS-1-5-201/19/2018 9:35:55 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
MSVDS__PROVIDER provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4348; ProviderPath = %systemroot%\system32\wbem\vdswmi.dll585700004611686018427387904467Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational43484632WIN-5T344G8GM1HS-1-5-201/19/2018 9:35:41 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4348; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll585700004611686018427387904466Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational43484632WIN-5T344G8GM1HS-1-5-201/19/2018 9:35:41 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
nettcpip provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4824; ProviderPath = %systemroot%\system32\wbem\NetTCPIP.dll585700004611686018427387904465Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational48241600WIN-5T344G8GM1HS-1-5-201/19/2018 9:34:04 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NetAdapterCim provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1548; ProviderPath = %systemroot%\system32\wbem\NetAdapterCim.dll585700004611686018427387904464Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational15482160WIN-5T344G8GM1HS-1-5-191/19/2018 9:34:04 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4824; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll585700004611686018427387904463Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational48241600WIN-5T344G8GM1HS-1-5-201/19/2018 9:34:04 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4824; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll585700004611686018427387904462Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational48244808WIN-5T344G8GM1HS-1-5-201/19/2018 9:34:04 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 764; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll585700004611686018427387904461Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational7641020WIN-5T344G8GM1HS-1-5-181/19/2018 9:33:46 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
MSVDS__PROVIDER provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4824; ProviderPath = %systemroot%\system32\wbem\vdswmi.dll585700004611686018427387904460Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational48244808WIN-5T344G8GM1HS-1-5-201/19/2018 9:32:20 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4824; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll585700004611686018427387904459Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational48244808WIN-5T344G8GM1HS-1-5-201/19/2018 9:32:20 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WMIProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3968; ProviderPath = %systemroot%\system32\wbem\wmiprov.dll585700004611686018427387904458Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational39684084WIN-5T344G8GM1HS-1-5-181/19/2018 9:31:16 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
MSVDS__PROVIDER provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1520; ProviderPath = %systemroot%\system32\wbem\vdswmi.dll585700004611686018427387904457Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational15202704WIN-5T344G8GM1HS-1-5-201/19/2018 9:29:44 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1520; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll585700004611686018427387904456Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational15202704WIN-5T344G8GM1HS-1-5-201/19/2018 9:29:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {4693033F-66F0-46C4-8E27-99621765768B}; ClientMachine = WIN-5T344G8GM1H; User = WIN-5T344G8GM1H\Administrator; ClientProcessId = 4124; Component = Core; Operation = Start IWbemServices::ExecMethod - root\microsoft\windows\servermanager : MSFT_ServerManagerTasks::GetServerFeature; ResultCode = 0x800706BE; PossibleCause = Could not send status to client585802004611686018427387904455Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562716WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:32 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {4693033F-66F0-46C4-8E27-99621765768B}; ClientMachine = WIN-5T344G8GM1H; User = WIN-5T344G8GM1H\Administrator; ClientProcessId = 4124; Component = Unknown; Operation = Start IWbemServices::ExecMethod - root\microsoft\windows\servermanager : MSFT_ServerManagerTasks::GetServerFeature; ResultCode = 0x80041032; PossibleCause = Unknown585802004611686018427387904454Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational956432WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:32 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4608; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll585700004611686018427387904453Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational46084636WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:30 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
nettcpip provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2872; ProviderPath = %systemroot%\system32\wbem\NetTCPIP.dll585700004611686018427387904452Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational28722896WIN-5T344G8GM1HS-1-5-201/19/2018 9:27:26 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NetAdapterCim provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4344; ProviderPath = %systemroot%\system32\wbem\NetAdapterCim.dll585700004611686018427387904451Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational43444368WIN-5T344G8GM1HS-1-5-191/19/2018 9:27:26 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2872; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll585700004611686018427387904450Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational28722900WIN-5T344G8GM1HS-1-5-201/19/2018 9:27:25 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
MSVDS__PROVIDER provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2872; ProviderPath = %systemroot%\system32\wbem\vdswmi.dll585700004611686018427387904449Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational28722900WIN-5T344G8GM1HS-1-5-201/19/2018 9:27:20 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32a provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2872; ProviderPath = %systemroot%\system32\wbem\wmipcima.dll585700004611686018427387904448Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational28722900WIN-5T344G8GM1HS-1-5-201/19/2018 9:27:19 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Namespace = //./root/CIMV2; NotificationQuery = select * from MSFT_SCMEventLogEvent; OwnerName = S-1-5-32-544; HostProcessID = 956; Provider= SCM Event Provider, queryID = 0; PossibleCause = Permanent585900004611686018427387904447Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562284WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:18 AMaff0bd57-9107-0002-9bbd-f0af0791d301microsoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Namespace = root\virtualization\v2; NotificationQuery = SELECT * FROM __ClassOperationEvent; UserName = .\SYSTEM; ClientProcessID = 0, ClientMachine = ; PossibleCause = Temporary586000004611686018427387904446Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:18 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Namespace = //./root/subscription; Eventfilter = SCM Event Log Filter (refer to its activate eventid:5859); Consumer = NTEventLogEventConsumer="SCM Event Log Consumer"; PossibleCause = Binding EventFilter: instance of __EventFilter { CreatorSID = {1, 2, 0, 0, 0, 0, 0, 5, 32, 0, 0, 0, 32, 2, 0, 0}; EventNamespace = "root\\cimv2"; Name = "SCM Event Log Filter"; Query = "select * from MSFT_SCMEventLogEvent"; QueryLanguage = "WQL"; }; Perm. Consumer: instance of NTEventLogEventConsumer { Category = 0; CreatorSID = {1, 2, 0, 0, 0, 0, 0, 5, 32, 0, 0, 0, 32, 2, 0, 0}; EventType = 1; Name = "SCM Event Log Consumer"; NameOfUserSIDProperty = "sid"; SourceName = "Service Control Manager"; }; 586100004611686018427387904445Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562284WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:18 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{FC491EF1-C4AA-4CE1-B329-414B101DB823}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904444Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{fbf687e6-f063-4d9f-9f4f-fd9a26acdd5f}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904443Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{FB2CA36D-0B40-4307-821B-A13B252DE56C}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904442Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{f3ccc681-b74c-4060-9f26-cd84525dca2a}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904441Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{F312195E-3D9D-447A-A3F5-08DFFA24735E}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904440Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{E62688F0-25FD-4c90-BFF5-F508B9D2E31F}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904439Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{E5094040-C46C-4115-B030-04FB2E545B00}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904438Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{E4F48E54-F38D-4884-BFB9-D4D2E5729C18}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904437Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{e437bc1c-aa7d-11d2-a382-00c04f991e27}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904436Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{CF7639F3-ABA2-41DB-97F2-81E2C5DBFC5D}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904435Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{cdeafc3d-948d-49dd-ab12-e578ba4af7aa}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904434Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{c6dc5466-785a-11d2-84d0-00c04fb169f7}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904433Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{C631DF4C-088F-4156-B058-4375F0853CD8}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904432Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{C418DD9D-0D14-4efb-8FBF-CFE535C8FAC7}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904431Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{C34B2751-1CF4-44F5-9262-C3FC39666591}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904430Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{BC75B1ED-5833-4858-9BB8-CBF0B166DF9D}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904429Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{BA649533-0AAC-4E04-B9BC-4DBAE0325B12}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904428Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{B587E2B1-4D59-4e7e-AED9-22B9DF11D053}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904427Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{B087BE9D-ED37-454f-AF9C-04291E351182}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904426Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{AADCED64-746C-4633-A97C-D61349046527}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904425Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{A3F3E39B-5D83-4940-B954-28315B82F0A8}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904424Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{91FBB303-0CD5-4055-BF42-E512A681B325}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904423Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{8A28E2C5-8D06-49A4-A08C-632DAA493E17}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904422Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{827D319E-6EAC-11D2-A4EA-00C04F79F83A}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904421Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{7B849a69-220F-451E-B3FE-2CB811AF94AE}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904420Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562864WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{7933F41E-56F8-41d6-A31C-4148A711EE93}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904419Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562864WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{74EE6C03-5363-4554-B161-627540339CAB}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904418Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562864WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{728EE579-943C-4519-9EF7-AB56765798ED}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904417Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562864WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{7150F9BF-48AD-4da4-A49C-29EF4A8369BA}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904416Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562864WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{6A4C88C6-C502-4f74-8F60-2CB23EDC24E2}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904415Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562864WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{6232C319-91AC-4931-9385-E70C2B099F0E}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904414Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562864WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{4CFB60C1-FAA6-47f1-89AA-0B18730C9FD3}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904413Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562868WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{4bcd6cde-777b-48b6-9804-43568e23545d}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904412Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{4B7C3B0F-E993-4E06-A241-3FBE06943684}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904411Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{42B5FAAE-6536-11d2-AE5A-0000F87571E3}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904410Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562864WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{426031c0-0b47-4852-b0ca-ac3d37bfcb39}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904409Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562864WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{3A0DBA37-F8B2-4356-83DE-3E90BD5C261F}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904408Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562864WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{3610eda5-77ef-11d2-8dc5-00c04fa31a66}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904407Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562864WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{2BFCC077-22D2-48DE-BDE1-2F618D9B476D}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904406Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562864WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{2A8FDC61-2347-4C87-92F6-B05EB91A201A}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904405Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562868WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{1A6364EB-776B-4120-ADE1-B63A406A76B5}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904404Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562864WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{17D89FEC-5C44-4972-B12D-241CAEF74509}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904403Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562864WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{16be69fa-4209-4250-88cb-716cf41954e0}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904402Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562864WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{169EBF44-942F-4C43-87CE-13C93996EBBE}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904401Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{0E28E245-9368-4853-AD84-6DA3BA35BB75}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904400Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{0ACDD40C-75AC-47ab-BAA0-BF6DE7E7FE63}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904399Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{FC491EF1-C4AA-4CE1-B329-414B101DB823}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904398Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{fbf687e6-f063-4d9f-9f4f-fd9a26acdd5f}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904397Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{FB2CA36D-0B40-4307-821B-A13B252DE56C}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904396Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{f3ccc681-b74c-4060-9f26-cd84525dca2a}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904395Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{F312195E-3D9D-447A-A3F5-08DFFA24735E}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904394Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{E62688F0-25FD-4c90-BFF5-F508B9D2E31F}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904393Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{E5094040-C46C-4115-B030-04FB2E545B00}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904392Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{E4F48E54-F38D-4884-BFB9-D4D2E5729C18}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904391Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{e437bc1c-aa7d-11d2-a382-00c04f991e27}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904390Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{CF7639F3-ABA2-41DB-97F2-81E2C5DBFC5D}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904389Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{cdeafc3d-948d-49dd-ab12-e578ba4af7aa}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904388Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{c6dc5466-785a-11d2-84d0-00c04fb169f7}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904387Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{C631DF4C-088F-4156-B058-4375F0853CD8}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904386Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{C418DD9D-0D14-4efb-8FBF-CFE535C8FAC7}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904385Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{C34B2751-1CF4-44F5-9262-C3FC39666591}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904384Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{BC75B1ED-5833-4858-9BB8-CBF0B166DF9D}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904383Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{BA649533-0AAC-4E04-B9BC-4DBAE0325B12}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904382Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{B587E2B1-4D59-4e7e-AED9-22B9DF11D053}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904381Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{B087BE9D-ED37-454f-AF9C-04291E351182}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904380Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{AADCED64-746C-4633-A97C-D61349046527}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904379Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{A3F3E39B-5D83-4940-B954-28315B82F0A8}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904378Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{91FBB303-0CD5-4055-BF42-E512A681B325}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904377Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{8A28E2C5-8D06-49A4-A08C-632DAA493E17}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904376Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{827D319E-6EAC-11D2-A4EA-00C04F79F83A}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904375Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{7B849a69-220F-451E-B3FE-2CB811AF94AE}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904374Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{7933F41E-56F8-41d6-A31C-4148A711EE93}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904373Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{74EE6C03-5363-4554-B161-627540339CAB}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904372Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{728EE579-943C-4519-9EF7-AB56765798ED}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904371Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{7150F9BF-48AD-4da4-A49C-29EF4A8369BA}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904370Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{6A4C88C6-C502-4f74-8F60-2CB23EDC24E2}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904369Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{6232C319-91AC-4931-9385-E70C2B099F0E}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904368Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{4CFB60C1-FAA6-47f1-89AA-0B18730C9FD3}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904367Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{4bcd6cde-777b-48b6-9804-43568e23545d}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904366Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{4B7C3B0F-E993-4E06-A241-3FBE06943684}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904365Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{42B5FAAE-6536-11d2-AE5A-0000F87571E3}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904364Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{426031c0-0b47-4852-b0ca-ac3d37bfcb39}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904363Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{3A0DBA37-F8B2-4356-83DE-3E90BD5C261F}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904362Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{3610eda5-77ef-11d2-8dc5-00c04fa31a66}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904361Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{2BFCC077-22D2-48DE-BDE1-2F618D9B476D}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904360Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{2A8FDC61-2347-4C87-92F6-B05EB91A201A}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904359Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{1A6364EB-776B-4120-ADE1-B63A406A76B5}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904358Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{17D89FEC-5C44-4972-B12D-241CAEF74509}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904357Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{16be69fa-4209-4250-88cb-716cf41954e0}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904356Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{169EBF44-942F-4C43-87CE-13C93996EBBE}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904355Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{0E28E245-9368-4853-AD84-6DA3BA35BB75}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904354Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{0ACDD40C-75AC-47ab-BAA0-BF6DE7E7FE63}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904353Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2872; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll585700004611686018427387904352Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational28722900WIN-5T344G8GM1HS-1-5-201/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 2336; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\virtualization\v2 : Msvm_ResourcePoolComponent.Name="Microsoft|RDV Integration Component Resource Pool|V2.0"; ResultCode = 0x80041010; PossibleCause = Unknown585802004611686018427387904351Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562864WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Namespace = ROOT\virtualization\v2; NotificationQuery = SELECT * FROM __ClassOperationEvent; UserName = .\SYSTEM; ClientProcessID = 0, ClientMachine = ; PossibleCause = Temporary586000004611686018427387904350Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9682820WIN-5T344G8GM1HS-1-5-181/19/2018 9:26:58 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 2360; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\virtualization\v2 : Msvm_ResourcePoolComponent.Name="Microsoft|RDV Integration Component Resource Pool|V2.0"; ResultCode = 0x80041010; PossibleCause = Unknown585802004611686018427387904349Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9682820WIN-5T344G8GM1HS-1-5-181/19/2018 9:26:52 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\HyperVCluster\v2 : Msvm_VirtualHardDiskState; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904348Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9682820WIN-5T344G8GM1HS-1-5-181/19/2018 9:26:51 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\HyperVCluster\v2 : Msvm_VirtualHardDiskSettingData; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904347Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9682820WIN-5T344G8GM1HS-1-5-181/19/2018 9:26:51 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\HyperVCluster\v2 : Msvm_VirtualHardDiskInfo; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904346Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9682820WIN-5T344G8GM1HS-1-5-181/19/2018 9:26:51 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\HyperVCluster\v2 : Msvm_ServicingSettings; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904345Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9682820WIN-5T344G8GM1HS-1-5-181/19/2018 9:26:51 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\HyperVCluster\v2 : CIM_SettingsDefineState; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904344Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9682820WIN-5T344G8GM1HS-1-5-181/19/2018 9:26:51 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\HyperVCluster\v2 : CIM_ServiceAffectsElement; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904343Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9682820WIN-5T344G8GM1HS-1-5-181/19/2018 9:26:51 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\HyperVCluster\v2 : CIM_ManagedElement; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904342Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9682820WIN-5T344G8GM1HS-1-5-181/19/2018 9:26:51 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\HyperVCluster\v2 : CIM_ElementSettingData; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904341Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9682820WIN-5T344G8GM1HS-1-5-181/19/2018 9:26:51 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\HyperVCluster\v2 : CIM_ElementCapabilities; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904340Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9682820WIN-5T344G8GM1HS-1-5-181/19/2018 9:26:51 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\HyperVCluster\v2 : CIM_Dependency; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904339Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9682820WIN-5T344G8GM1HS-1-5-181/19/2018 9:26:51 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\HyperVCluster\v2 : CIM_Component; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904338Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9682820WIN-5T344G8GM1HS-1-5-181/19/2018 9:26:51 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\HyperVCluster\v2 : CIM_AffectedJobElement; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904337Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9682820WIN-5T344G8GM1HS-1-5-181/19/2018 9:26:51 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\HyperVCluster\v2\ms_409 : Msvm_SummaryInformationBase; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904336Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9682820WIN-5T344G8GM1HS-1-5-181/19/2018 9:26:51 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\HyperVCluster\v2\ms_409 : CIM_SettingsDefineState; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904335Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9682820WIN-5T344G8GM1HS-1-5-181/19/2018 9:26:51 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\HyperVCluster\v2\ms_409 : CIM_ServiceAffectsElement; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904334Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9682824WIN-5T344G8GM1HS-1-5-181/19/2018 9:26:51 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\HyperVCluster\v2\ms_409 : CIM_ManagedElement; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904333Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9682820WIN-5T344G8GM1HS-1-5-181/19/2018 9:26:51 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\HyperVCluster\v2\ms_409 : CIM_ElementSettingData; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904332Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9682820WIN-5T344G8GM1HS-1-5-181/19/2018 9:26:51 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\HyperVCluster\v2\ms_409 : CIM_ElementCapabilities; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904331Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9682820WIN-5T344G8GM1HS-1-5-181/19/2018 9:26:51 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\HyperVCluster\v2\ms_409 : CIM_Dependency; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904330Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9682820WIN-5T344G8GM1HS-1-5-181/19/2018 9:26:51 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\HyperVCluster\v2\ms_409 : CIM_Component; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904329Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9682820WIN-5T344G8GM1HS-1-5-181/19/2018 9:26:51 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\HyperVCluster\v2\ms_409 : CIM_AffectedJobElement; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904328Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9682820WIN-5T344G8GM1HS-1-5-181/19/2018 9:26:51 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Namespace = //./root/CIMV2; NotificationQuery = select * from MSFT_SCMEventLogEvent; OwnerName = S-1-5-32-544; HostProcessID = 968; Provider= SCM Event Provider, queryID = 0; PossibleCause = Permanent585900004611686018427387904327Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9682948WIN-5T344G8GM1HS-1-5-181/19/2018 9:26:51 AM96ed06e7-9107-0000-3d07-ed960791d301microsoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Namespace = //./root/subscription; Eventfilter = SCM Event Log Filter (refer to its activate eventid:5859); Consumer = NTEventLogEventConsumer="SCM Event Log Consumer"; PossibleCause = Binding EventFilter: instance of __EventFilter { CreatorSID = {1, 2, 0, 0, 0, 0, 0, 5, 32, 0, 0, 0, 32, 2, 0, 0}; EventNamespace = "root\\cimv2"; Name = "SCM Event Log Filter"; Query = "select * from MSFT_SCMEventLogEvent"; QueryLanguage = "WQL"; }; Perm. Consumer: instance of NTEventLogEventConsumer { Category = 0; CreatorSID = {1, 2, 0, 0, 0, 0, 0, 5, 32, 0, 0, 0, 32, 2, 0, 0}; EventType = 1; Name = "SCM Event Log Consumer"; NameOfUserSIDProperty = "sid"; SourceName = "Service Control Manager"; }; 586100004611686018427387904326Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9682948WIN-5T344G8GM1HS-1-5-181/19/2018 9:26:51 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2 : Msvm_VirtualDiskChangedRange; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904325Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9682820WIN-5T344G8GM1HS-1-5-181/19/2018 9:26:50 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2 : Msvm_VHDSSnapshotInformation; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904324Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9682820WIN-5T344G8GM1HS-1-5-181/19/2018 9:26:50 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2 : Msvm_VHDSetInformation; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904323Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9682820WIN-5T344G8GM1HS-1-5-181/19/2018 9:26:50 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2 : Msvm_VirtualHardDiskSettingData; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904322Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9682820WIN-5T344G8GM1HS-1-5-181/19/2018 9:26:50 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2 : Msvm_VirtualHardDiskInfo; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904321Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9682820WIN-5T344G8GM1HS-1-5-181/19/2018 9:26:50 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2 : Msvm_SummaryInformationBase; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904320Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9682820WIN-5T344G8GM1HS-1-5-181/19/2018 9:26:50 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2 : Msvm_ServicingSettings; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904319Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9682820WIN-5T344G8GM1HS-1-5-181/19/2018 9:26:50 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2 : CIM_SettingsDefineState; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904318Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9682820WIN-5T344G8GM1HS-1-5-181/19/2018 9:26:50 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2 : CIM_ServiceAffectsElement; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904317Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9682820WIN-5T344G8GM1HS-1-5-181/19/2018 9:26:50 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2 : CIM_ManagedElement; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904316Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9682820WIN-5T344G8GM1HS-1-5-181/19/2018 9:26:50 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2 : CIM_ElementSettingData; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904315Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9682820WIN-5T344G8GM1HS-1-5-181/19/2018 9:26:50 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2 : CIM_ElementCapabilities; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904314Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9682820WIN-5T344G8GM1HS-1-5-181/19/2018 9:26:50 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2 : CIM_Dependency; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904313Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9682820WIN-5T344G8GM1HS-1-5-181/19/2018 9:26:50 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2 : CIM_Component; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904312Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9682820WIN-5T344G8GM1HS-1-5-181/19/2018 9:26:50 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2 : CIM_AffectedJobElement; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904311Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9682820WIN-5T344G8GM1HS-1-5-181/19/2018 9:26:50 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2\ms_409 : Msvm_VirtualDiskChangedRange; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904310Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9682820WIN-5T344G8GM1HS-1-5-181/19/2018 9:26:49 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2\ms_409 : Msvm_VHDSSnapshotInformation; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904309Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9682820WIN-5T344G8GM1HS-1-5-181/19/2018 9:26:49 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2\ms_409 : Msvm_VHDSetInformation; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904308Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9682820WIN-5T344G8GM1HS-1-5-181/19/2018 9:26:49 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2\ms_409 : Msvm_VirtualHardDiskSettingData; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904307Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9682820WIN-5T344G8GM1HS-1-5-181/19/2018 9:26:49 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2\ms_409 : Msvm_VirtualHardDiskInfo; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904306Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9682820WIN-5T344G8GM1HS-1-5-181/19/2018 9:26:49 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2\ms_409 : Msvm_SummaryInformationBase; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904305Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9682820WIN-5T344G8GM1HS-1-5-181/19/2018 9:26:49 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2\ms_409 : Msvm_ServicingSettings; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904304Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9682820WIN-5T344G8GM1HS-1-5-181/19/2018 9:26:49 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2\ms_409 : CIM_SettingsDefineState; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904303Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9682820WIN-5T344G8GM1HS-1-5-181/19/2018 9:26:49 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2\ms_409 : CIM_ServiceAffectsElement; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904302Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9682820WIN-5T344G8GM1HS-1-5-181/19/2018 9:26:49 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2\ms_409 : CIM_ManagedElement; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904301Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9682820WIN-5T344G8GM1HS-1-5-181/19/2018 9:26:49 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2\ms_409 : CIM_ElementSettingData; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904300Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9682820WIN-5T344G8GM1HS-1-5-181/19/2018 9:26:49 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2\ms_409 : CIM_ElementCapabilities; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904299Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9682820WIN-5T344G8GM1HS-1-5-181/19/2018 9:26:49 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2\ms_409 : CIM_Dependency; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904298Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9682820WIN-5T344G8GM1HS-1-5-181/19/2018 9:26:49 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2\ms_409 : CIM_Component; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904297Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9682820WIN-5T344G8GM1HS-1-5-181/19/2018 9:26:49 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2\ms_409 : CIM_AffectedJobElement; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904296Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9682820WIN-5T344G8GM1HS-1-5-181/19/2018 9:26:49 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
MSVDS__PROVIDER provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2840; ProviderPath = %systemroot%\system32\wbem\vdswmi.dll585700004611686018427387904295Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational28402880WIN-5T344G8GM1HS-1-5-201/19/2018 9:26:46 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32a provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2840; ProviderPath = %systemroot%\system32\wbem\wmipcima.dll585700004611686018427387904294Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational28402880WIN-5T344G8GM1HS-1-5-201/19/2018 9:26:44 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2840; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll585700004611686018427387904293Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational28402864WIN-5T344G8GM1HS-1-5-201/19/2018 9:26:42 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 308; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_ComputerSystem; ResultCode = 0x80041032; PossibleCause = Unknown585802004611686018427387904292Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562620WIN-5T344G8GM1HS-1-5-181/19/2018 9:25:03 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 308; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_ComputerSystem; ResultCode = 0x80041032; PossibleCause = Unknown585802004611686018427387904291Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational956404WIN-5T344G8GM1HS-1-5-181/19/2018 9:25:02 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2528; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll585700004611686018427387904290Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational25283456WIN-5T344G8GM1HS-1-5-181/19/2018 9:24:56 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
nettcpip provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2508; ProviderPath = %systemroot%\system32\wbem\NetTCPIP.dll585700004611686018427387904289Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational25084092WIN-5T344G8GM1HS-1-5-201/19/2018 9:24:53 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NetAdapterCim provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2736; ProviderPath = %systemroot%\system32\wbem\NetAdapterCim.dll585700004611686018427387904288Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational27363804WIN-5T344G8GM1HS-1-5-191/19/2018 9:24:53 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2508; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll585700004611686018427387904287Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational25084092WIN-5T344G8GM1HS-1-5-201/19/2018 9:24:53 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2508; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll585700004611686018427387904286Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational25082824WIN-5T344G8GM1HS-1-5-201/19/2018 9:24:53 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3200; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll585700004611686018427387904285Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational32003644WIN-5T344G8GM1HS-1-5-181/19/2018 9:23:15 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
nettcpip provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2856; ProviderPath = %systemroot%\system32\wbem\NetTCPIP.dll585700004611686018427387904284Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational28562920WIN-5T344G8GM1HS-1-5-201/19/2018 9:23:12 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NetAdapterCim provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2540; ProviderPath = %systemroot%\system32\wbem\NetAdapterCim.dll585700004611686018427387904283Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational25403240WIN-5T344G8GM1HS-1-5-191/19/2018 9:23:12 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2856; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll585700004611686018427387904282Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational28562884WIN-5T344G8GM1HS-1-5-201/19/2018 9:23:11 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
MSVDS__PROVIDER provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2856; ProviderPath = %systemroot%\system32\wbem\vdswmi.dll585700004611686018427387904281Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational28562884WIN-5T344G8GM1HS-1-5-201/19/2018 9:23:05 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32a provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2856; ProviderPath = %systemroot%\system32\wbem\wmipcima.dll585700004611686018427387904280Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational28562884WIN-5T344G8GM1HS-1-5-201/19/2018 9:23:04 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Namespace = //./root/CIMV2; NotificationQuery = select * from MSFT_SCMEventLogEvent; OwnerName = S-1-5-32-544; HostProcessID = 956; Provider= SCM Event Provider, queryID = 0; PossibleCause = Permanent585900004611686018427387904279Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562916WIN-5T344G8GM1HS-1-5-181/19/2018 9:23:03 AM17f2f0cc-9107-0002-12f1-f2170791d301microsoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Namespace = //./root/subscription; Eventfilter = SCM Event Log Filter (refer to its activate eventid:5859); Consumer = NTEventLogEventConsumer="SCM Event Log Consumer"; PossibleCause = Binding EventFilter: instance of __EventFilter { CreatorSID = {1, 2, 0, 0, 0, 0, 0, 5, 32, 0, 0, 0, 32, 2, 0, 0}; EventNamespace = "root\\cimv2"; Name = "SCM Event Log Filter"; Query = "select * from MSFT_SCMEventLogEvent"; QueryLanguage = "WQL"; }; Perm. Consumer: instance of NTEventLogEventConsumer { Category = 0; CreatorSID = {1, 2, 0, 0, 0, 0, 0, 5, 32, 0, 0, 0, 32, 2, 0, 0}; EventType = 1; Name = "SCM Event Log Consumer"; NameOfUserSIDProperty = "sid"; SourceName = "Service Control Manager"; }; 586100004611686018427387904278Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562908WIN-5T344G8GM1HS-1-5-181/19/2018 9:23:03 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2856; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll585700004611686018427387904277Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational28562884WIN-5T344G8GM1HS-1-5-201/19/2018 9:23:02 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3808; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll585700004611686018427387904276Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational38084032WIN-5T344G8GM1HS-1-5-181/19/2018 9:14:59 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
nettcpip provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2664; ProviderPath = %systemroot%\system32\wbem\NetTCPIP.dll585700004611686018427387904275Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational26642720WIN-5T344G8GM1HS-1-5-201/19/2018 9:14:58 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NetAdapterCim provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2972; ProviderPath = %systemroot%\system32\wbem\NetAdapterCim.dll585700004611686018427387904274Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational2972156WIN-5T344G8GM1HS-1-5-191/19/2018 9:14:58 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2664; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll585700004611686018427387904273Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational26642720WIN-5T344G8GM1HS-1-5-201/19/2018 9:14:57 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2664; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll585700004611686018427387904272Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational26641584WIN-5T344G8GM1HS-1-5-201/19/2018 9:14:57 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = WIN-5T344G8GM1H\Administrator; ClientProcessId = 1860; Component = Unknown; Operation = Start IWbemServices::PutInstance - root\cimv2 : Win32_ComputerSystem.Name="WIN-5T344G8GM1H"; ResultCode = 0x80041001; PossibleCause = Unknown585802004611686018427387904271Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational11804136WIN-5T344G8GM1HS-1-5-181/19/2018 9:11:39 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4368; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll585700004611686018427387904270Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational43684496WIN-5T344G8GM1HS-1-5-201/19/2018 9:10:55 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1784; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll585700004611686018427387904269Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational17842240WIN-5T344G8GM1HS-1-5-181/19/2018 9:05:00 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
nettcpip provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 952; ProviderPath = %systemroot%\system32\wbem\NetTCPIP.dll585700004611686018427387904268Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational952452WIN-5T344G8GM1HS-1-5-201/19/2018 9:04:58 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NetAdapterCim provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1152; ProviderPath = %systemroot%\system32\wbem\NetAdapterCim.dll585700004611686018427387904267Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational11521396WIN-5T344G8GM1HS-1-5-191/19/2018 9:04:58 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 952; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll585700004611686018427387904266Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational952452WIN-5T344G8GM1HS-1-5-201/19/2018 9:04:57 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 952; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll585700004611686018427387904265Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9521000WIN-5T344G8GM1HS-1-5-201/19/2018 9:04:57 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WMIProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3176; ProviderPath = %systemroot%\system32\wbem\wmiprov.dll585700004611686018427387904264Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational31763364WIN-5T344G8GM1HS-1-5-181/19/2018 8:58:49 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
MSVDS__PROVIDER provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4672; ProviderPath = %systemroot%\system32\wbem\vdswmi.dll585700004611686018427387904263Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational46724700WIN-5T344G8GM1HS-1-5-201/19/2018 8:57:50 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4672; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll585700004611686018427387904262Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational46724700WIN-5T344G8GM1HS-1-5-201/19/2018 8:57:50 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 88; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_ComputerSystemProduct; ResultCode = 0x80041032; PossibleCause = Unknown585802004611686018427387904261Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational11801284WIN-5T344G8GM1HS-1-5-181/19/2018 8:56:50 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4672; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll585700004611686018427387904260Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational46724700WIN-5T344G8GM1HS-1-5-201/19/2018 8:56:50 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Namespace = //./root/CIMV2; NotificationQuery = select * from MSFT_SCMEventLogEvent; OwnerName = S-1-5-32-544; HostProcessID = 1180; Provider= SCM Event Provider, queryID = 0; PossibleCause = Permanent585900004611686018427387904259Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational11804340WIN-5T344G8GM1HS-1-5-181/19/2018 8:56:46 AM289cfce6-9103-0003-f9fd-9c280391d301microsoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Namespace = //./root/subscription; Eventfilter = SCM Event Log Filter (refer to its activate eventid:5859); Consumer = NTEventLogEventConsumer="SCM Event Log Consumer"; PossibleCause = Binding EventFilter: instance of __EventFilter { CreatorSID = {1, 2, 0, 0, 0, 0, 0, 5, 32, 0, 0, 0, 32, 2, 0, 0}; EventNamespace = "root\\cimv2"; Name = "SCM Event Log Filter"; Query = "select * from MSFT_SCMEventLogEvent"; QueryLanguage = "WQL"; }; Perm. Consumer: instance of NTEventLogEventConsumer { Category = 0; CreatorSID = {1, 2, 0, 0, 0, 0, 0, 5, 32, 0, 0, 0, 32, 2, 0, 0}; EventType = 1; Name = "SCM Event Log Consumer"; NameOfUserSIDProperty = "sid"; SourceName = "Service Control Manager"; }; 586100004611686018427387904258Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational11804340WIN-5T344G8GM1HS-1-5-181/19/2018 8:56:46 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
MSVDS__PROVIDER provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3968; ProviderPath = %systemroot%\system32\wbem\vdswmi.dll585700004611686018427387904257Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational39684008WIN-5T344G8GM1HS-1-5-201/19/2018 8:55:06 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32a provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3968; ProviderPath = %systemroot%\system32\wbem\wmipcima.dll585700004611686018427387904256Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational39684008WIN-5T344G8GM1HS-1-5-201/19/2018 8:55:05 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3688; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll585700004611686018427387904255Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational36883696WIN-5T344G8GM1HS-1-5-181/19/2018 8:55:04 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
nettcpip provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3968; ProviderPath = %systemroot%\system32\wbem\NetTCPIP.dll585700004611686018427387904254Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational39684020WIN-5T344G8GM1HS-1-5-201/19/2018 8:54:58 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NetAdapterCim provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4024; ProviderPath = %systemroot%\system32\wbem\NetAdapterCim.dll585700004611686018427387904253Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational40244052WIN-5T344G8GM1HS-1-5-191/19/2018 8:54:58 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3968; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll585700004611686018427387904252Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational39684008WIN-5T344G8GM1HS-1-5-201/19/2018 8:54:58 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3968; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll585700004611686018427387904251Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational39683996WIN-5T344G8GM1HS-1-5-201/19/2018 8:54:58 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3880; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll585700004611686018427387904250Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational38803916WIN-5T344G8GM1HS-1-5-201/19/2018 8:54:38 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {7C5C4FFB-9102-0000-4A51-5C7C0291D301}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 1192; Component = Unknown; Operation = Start IWbemServices::ExecNotificationQuery - ROOT\CIMV2 : SELECT * FROM Win32_ProcessStartTrace WHERE ProcessName = 'wsmprovhost.exe'; ResultCode = 0x80041032; PossibleCause = Unknown585802004611686018427387904249Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational11923004WIN-5T344G8GM1HS-1-5-181/19/2018 8:54:34 AM7c5c4ffb-9102-0000-4a51-5c7c0291d301microsoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WMIProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1200; ProviderPath = %systemroot%\system32\wbem\wmiprov.dll585700004611686018427387904248Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational12002840WIN-5T344G8GM1HS-1-5-181/19/2018 8:54:03 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Namespace = ROOT\CIMV2; NotificationQuery = SELECT * FROM Win32_ProcessStartTrace WHERE ProcessName = 'wsmprovhost.exe'; UserName = ; ClientProcessID = 1192, ClientMachine = WIN-5T344G8GM1H; PossibleCause = Temporary586000004611686018427387904247Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational11922792WIN-5T344G8GM1HS-1-5-181/19/2018 8:52:27 AM7c5c4ffb-9102-0001-8851-5c7c0291d301microsoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WMI Kernel Trace Event Provider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1192; ProviderPath = C:\Windows\System32\wbem\krnlprov.dll585700004611686018427387904246Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational11922792WIN-5T344G8GM1HS-1-5-181/19/2018 8:52:27 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Namespace = //./root/CIMV2; NotificationQuery = select * from MSFT_SCMEventLogEvent; OwnerName = S-1-5-32-544; HostProcessID = 1192; Provider= SCM Event Provider, queryID = 0; PossibleCause = Permanent585900004611686018427387904245Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational11922796WIN-5T344G8GM1HS-1-5-181/19/2018 8:51:57 AM7c5c4ffb-9102-0001-5f51-5c7c0291d301microsoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Namespace = //./root/subscription; Eventfilter = SCM Event Log Filter (refer to its activate eventid:5859); Consumer = NTEventLogEventConsumer="SCM Event Log Consumer"; PossibleCause = Binding EventFilter: instance of __EventFilter { CreatorSID = {1, 2, 0, 0, 0, 0, 0, 5, 32, 0, 0, 0, 32, 2, 0, 0}; EventNamespace = "root\\cimv2"; Name = "SCM Event Log Filter"; Query = "select * from MSFT_SCMEventLogEvent"; QueryLanguage = "WQL"; }; Perm. Consumer: instance of NTEventLogEventConsumer { Category = 0; CreatorSID = {1, 2, 0, 0, 0, 0, 0, 5, 32, 0, 0, 0, 32, 2, 0, 0}; EventType = 1; Name = "SCM Event Log Consumer"; NameOfUserSIDProperty = "sid"; SourceName = "Service Control Manager"; }; 586100004611686018427387904244Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational11922796WIN-5T344G8GM1HS-1-5-181/19/2018 8:51:57 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
MSVDS__PROVIDER provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3832; ProviderPath = %systemroot%\system32\wbem\vdswmi.dll585700004611686018427387904243Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational38323932WIN-5T344G8GM1HS-1-5-201/19/2018 8:51:38 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32a provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3832; ProviderPath = %systemroot%\system32\wbem\wmipcima.dll585700004611686018427387904242Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational38323872WIN-5T344G8GM1HS-1-5-201/19/2018 8:51:37 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 428; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll585700004611686018427387904241Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational4281316WIN-5T344G8GM1HS-1-5-181/19/2018 8:51:13 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
nettcpip provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3832; ProviderPath = %systemroot%\system32\wbem\NetTCPIP.dll585700004611686018427387904240Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational38323872WIN-5T344G8GM1HS-1-5-201/19/2018 8:51:04 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NetAdapterCim provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3888; ProviderPath = %systemroot%\system32\wbem\NetAdapterCim.dll585700004611686018427387904239Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational38883916WIN-5T344G8GM1HS-1-5-191/19/2018 8:51:04 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3832; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll585700004611686018427387904238Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational38323872WIN-5T344G8GM1HS-1-5-201/19/2018 8:51:04 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3832; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll585700004611686018427387904237Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational38323860WIN-5T344G8GM1HS-1-5-201/19/2018 8:51:04 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4796; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll585700004611686018427387904236Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational4796840WIN-5T344G8GM1HS-1-5-201/19/2018 8:45:55 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2284; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll585700004611686018427387904235Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational22842676WIN-5T344G8GM1HS-1-5-181/19/2018 8:44:15 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
nettcpip provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2548; ProviderPath = %systemroot%\system32\wbem\NetTCPIP.dll585700004611686018427387904234Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational25482728WIN-5T344G8GM1HS-1-5-201/19/2018 8:44:08 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NetAdapterCim provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2300; ProviderPath = %systemroot%\system32\wbem\NetAdapterCim.dll585700004611686018427387904233Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational23004360WIN-5T344G8GM1HS-1-5-191/19/2018 8:44:08 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2548; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll585700004611686018427387904232Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational25482728WIN-5T344G8GM1HS-1-5-201/19/2018 8:44:08 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2548; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll585700004611686018427387904231Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational25483736WIN-5T344G8GM1HS-1-5-201/19/2018 8:44:08 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1052; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll585700004611686018427387904230Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational10524868WIN-5T344G8GM1HS-1-5-201/19/2018 8:36:56 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3184; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll585700004611686018427387904229Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational3184404WIN-5T344G8GM1HS-1-5-181/19/2018 8:34:15 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Win32_WIN32_TERMINALSERVICE_Prov provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1164; ProviderPath = %SystemRoot%\system32\tscfgwmi.dll585700004611686018427387904228Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational11644616WIN-5T344G8GM1HS-1-5-201/19/2018 8:34:14 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4600; Component = Unknown; Operation = Start IWbemServices::ExecQuery - ROOT\WMI : SELECT * FROM BatteryStaticData; ResultCode = 0x80041010; PossibleCause = Unknown585802004611686018427387904227Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9644904WIN-5T344G8GM1HS-1-5-181/19/2018 8:34:14 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4600; Component = Unknown; Operation = Start IWbemServices::ExecQuery - ROOT\WMI : SELECT * FROM BatteryFullChargedCapacity; ResultCode = 0x80041010; PossibleCause = Unknown585802004611686018427387904226Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9644904WIN-5T344G8GM1HS-1-5-181/19/2018 8:34:13 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
PowerWmiProvider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1164; ProviderPath = %SYSTEMROOT%\system32\PowerWmiProvider.dll585700004611686018427387904225Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational11641368WIN-5T344G8GM1HS-1-5-201/19/2018 8:34:13 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
StorageWMI provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1164; ProviderPath = %SystemRoot%\System32\storagewmi.dll585700004611686018427387904224Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational11641368WIN-5T344G8GM1HS-1-5-201/19/2018 8:34:11 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
MSVDS__PROVIDER provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1164; ProviderPath = %systemroot%\system32\wbem\vdswmi.dll585700004611686018427387904223Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational11641368WIN-5T344G8GM1HS-1-5-201/19/2018 8:34:11 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
nettcpip provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1164; ProviderPath = %systemroot%\system32\wbem\NetTCPIP.dll585700004611686018427387904222Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational11641368WIN-5T344G8GM1HS-1-5-201/19/2018 8:34:08 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NetAdapterCim provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2920; ProviderPath = %systemroot%\system32\wbem\NetAdapterCim.dll585700004611686018427387904221Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational29204532WIN-5T344G8GM1HS-1-5-191/19/2018 8:34:08 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1164; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll585700004611686018427387904220Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational11641368WIN-5T344G8GM1HS-1-5-201/19/2018 8:34:08 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1164; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll585700004611686018427387904219Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational11641532WIN-5T344G8GM1HS-1-5-201/19/2018 8:34:08 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9A81CB05-910F-0003-8ACC-819A0F91D301}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 964; Component = Unknown; Operation = Start IWbemServices::ExecNotificationQuery - ROOT\CIMV2 : SELECT * FROM Win32_ProcessStartTrace WHERE ProcessName = 'wsmprovhost.exe'; ResultCode = 0x80041032; PossibleCause = Unknown585802004611686018427387904218Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9644228WIN-5T344G8GM1HS-1-5-181/19/2018 8:33:15 AM9a81cb05-910f-0003-8acc-819a0f91d301microsoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3976; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\Microsoft\Windows\DeviceGuard : SELECT RequiredSecurityProperties FROM Win32_DeviceGuard ; ResultCode = 0x80041032; PossibleCause = Unknown585802004611686018427387904217Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9641824WIN-5T344G8GM1HS-1-5-181/19/2018 8:33:01 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3976; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\Microsoft\Windows\DeviceGuard : SELECT SecurityServicesConfigured FROM Win32_DeviceGuard ; ResultCode = 0x80041032; PossibleCause = Unknown585802004611686018427387904216Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9645076WIN-5T344G8GM1HS-1-5-181/19/2018 8:33:01 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Win32_TpmProvider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1164; ProviderPath = C:\Windows\system32\wbem\Win32_TPM.dll585700004611686018427387904215Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational11641532WIN-5T344G8GM1HS-1-5-201/19/2018 8:33:01 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3976; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\Microsoft\Windows\DeviceGuard : SELECT VirtualizationBasedSecurityStatus FROM Win32_DeviceGuard ; ResultCode = 0x80041032; PossibleCause = Unknown585802004611686018427387904214Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9645076WIN-5T344G8GM1HS-1-5-181/19/2018 8:33:01 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3976; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\Microsoft\Windows\DeviceGuard : SELECT SecurityServicesRunning FROM Win32_DeviceGuard ; ResultCode = 0x80041032; PossibleCause = Unknown585802004611686018427387904213Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9645076WIN-5T344G8GM1HS-1-5-181/19/2018 8:33:01 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3976; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\Microsoft\Windows\DeviceGuard : SELECT AvailableSecurityProperties FROM Win32_DeviceGuard ; ResultCode = 0x80041032; PossibleCause = Unknown585802004611686018427387904212Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9641824WIN-5T344G8GM1HS-1-5-181/19/2018 8:33:01 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3976; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\Microsoft\Windows\DeviceGuard : SELECT RequiredSecurityProperties FROM Win32_DeviceGuard ; ResultCode = 0x80041032; PossibleCause = Unknown585802004611686018427387904211Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9645076WIN-5T344G8GM1HS-1-5-181/19/2018 8:33:01 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Win32_DeviceGuard provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1164; ProviderPath = %SystemRoot%\System32\Win32_DeviceGuard.dll585700004611686018427387904210Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational11641532WIN-5T344G8GM1HS-1-5-201/19/2018 8:33:01 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3976; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\CIMV2 : SELECT SMBIOSAssetTag FROM Win32_SystemEnclosure ; ResultCode = 0x80041032; PossibleCause = Unknown585802004611686018427387904209Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9645076WIN-5T344G8GM1HS-1-5-181/19/2018 8:32:59 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
MSVDS__PROVIDER provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1164; ProviderPath = %systemroot%\system32\wbem\vdswmi.dll585700004611686018427387904208Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational11641532WIN-5T344G8GM1HS-1-5-201/19/2018 8:32:59 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1164; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll585700004611686018427387904207Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational11642868WIN-5T344G8GM1HS-1-5-201/19/2018 8:32:58 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1912; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll585700004611686018427387904206Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational19123084WIN-5T344G8GM1HS-1-5-181/19/2018 8:32:58 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
ServerFeatureProvider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1164; ProviderPath = %windir%\system32\wbem\servercompprov.dll585700004611686018427387904205Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational11641532WIN-5T344G8GM1HS-1-5-201/19/2018 8:32:58 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
MSVDS__PROVIDER provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 996; ProviderPath = %systemroot%\system32\wbem\vdswmi.dll585700004611686018427387904204Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational996456WIN-5T344G8GM1HS-1-5-201/19/2018 8:29:00 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 996; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll585700004611686018427387904203Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational996456WIN-5T344G8GM1HS-1-5-201/19/2018 8:29:00 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WMIProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4324; ProviderPath = %systemroot%\system32\wbem\wmiprov.dll585700004611686018427387904202Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational43243568WIN-5T344G8GM1HS-1-5-181/19/2018 8:27:56 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Namespace = ROOT\CIMV2; NotificationQuery = SELECT * FROM Win32_ProcessStartTrace WHERE ProcessName = 'wsmprovhost.exe'; UserName = ; ClientProcessID = 964, ClientMachine = WIN-5T344G8GM1H; PossibleCause = Temporary586000004611686018427387904201Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9643260WIN-5T344G8GM1HS-1-5-181/19/2018 8:26:55 AM9a81cb05-910f-0000-a4cc-819a0f91d301microsoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WMI Kernel Trace Event Provider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 964; ProviderPath = C:\Windows\System32\wbem\krnlprov.dll585700004611686018427387904200Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9643260WIN-5T344G8GM1HS-1-5-181/19/2018 8:26:55 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
MSVDS__PROVIDER provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3772; ProviderPath = %systemroot%\system32\wbem\vdswmi.dll585700004611686018427387904199Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational37723768WIN-5T344G8GM1HS-1-5-201/19/2018 8:26:50 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3772; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll585700004611686018427387904198Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational37723768WIN-5T344G8GM1HS-1-5-201/19/2018 8:25:57 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Namespace = //./root/CIMV2; NotificationQuery = select * from MSFT_SCMEventLogEvent; OwnerName = S-1-5-32-544; HostProcessID = 964; Provider= SCM Event Provider, queryID = 0; PossibleCause = Permanent585900004611686018427387904197Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9644648WIN-5T344G8GM1HS-1-5-181/19/2018 8:25:52 AM9a81cb05-910f-0003-4bcc-819a0f91d301microsoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Namespace = //./root/subscription; Eventfilter = SCM Event Log Filter (refer to its activate eventid:5859); Consumer = NTEventLogEventConsumer="SCM Event Log Consumer"; PossibleCause = Binding EventFilter: instance of __EventFilter { CreatorSID = {1, 2, 0, 0, 0, 0, 0, 5, 32, 0, 0, 0, 32, 2, 0, 0}; EventNamespace = "root\\cimv2"; Name = "SCM Event Log Filter"; Query = "select * from MSFT_SCMEventLogEvent"; QueryLanguage = "WQL"; }; Perm. Consumer: instance of NTEventLogEventConsumer { Category = 0; CreatorSID = {1, 2, 0, 0, 0, 0, 0, 5, 32, 0, 0, 0, 32, 2, 0, 0}; EventType = 1; Name = "SCM Event Log Consumer"; NameOfUserSIDProperty = "sid"; SourceName = "Service Control Manager"; }; 586100004611686018427387904196Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9644648WIN-5T344G8GM1HS-1-5-181/19/2018 8:25:52 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
MSVDS__PROVIDER provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3772; ProviderPath = %systemroot%\system32\wbem\vdswmi.dll585700004611686018427387904195Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational37723768WIN-5T344G8GM1HS-1-5-201/19/2018 8:24:46 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4124; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll585700004611686018427387904194Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational41244152WIN-5T344G8GM1HS-1-5-181/19/2018 8:24:15 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
nettcpip provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3772; ProviderPath = %systemroot%\system32\wbem\NetTCPIP.dll585700004611686018427387904193Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational37723820WIN-5T344G8GM1HS-1-5-201/19/2018 8:24:08 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NetAdapterCim provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3084; ProviderPath = %systemroot%\system32\wbem\NetAdapterCim.dll585700004611686018427387904192Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational30843436WIN-5T344G8GM1HS-1-5-191/19/2018 8:24:08 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3772; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll585700004611686018427387904191Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational37723800WIN-5T344G8GM1HS-1-5-201/19/2018 8:24:08 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32a provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3772; ProviderPath = %systemroot%\system32\wbem\wmipcima.dll585700004611686018427387904190Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational37723800WIN-5T344G8GM1HS-1-5-201/19/2018 8:24:03 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3772; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll585700004611686018427387904189Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational37723800WIN-5T344G8GM1HS-1-5-201/19/2018 8:24:03 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3868; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll585700004611686018427387904188Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational38683176WIN-5T344G8GM1HS-1-5-181/16/2018 6:37:16 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
nettcpip provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2504; ProviderPath = %systemroot%\system32\wbem\NetTCPIP.dll585700004611686018427387904187Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational25042192WIN-5T344G8GM1HS-1-5-201/16/2018 6:37:14 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NetAdapterCim provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2788; ProviderPath = %systemroot%\system32\wbem\NetAdapterCim.dll585700004611686018427387904186Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational27882624WIN-5T344G8GM1HS-1-5-191/16/2018 6:37:14 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2504; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll585700004611686018427387904185Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational25042192WIN-5T344G8GM1HS-1-5-201/16/2018 6:37:14 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2504; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll585700004611686018427387904184Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational25042440WIN-5T344G8GM1HS-1-5-201/16/2018 6:37:14 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4024; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll585700004611686018427387904183Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational40243868WIN-5T344G8GM1HS-1-5-181/16/2018 6:27:16 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
nettcpip provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1288; ProviderPath = %systemroot%\system32\wbem\NetTCPIP.dll585700004611686018427387904182Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational12883280WIN-5T344G8GM1HS-1-5-201/16/2018 6:27:14 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NetAdapterCim provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1500; ProviderPath = %systemroot%\system32\wbem\NetAdapterCim.dll585700004611686018427387904181Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational15002664WIN-5T344G8GM1HS-1-5-191/16/2018 6:27:14 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1288; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll585700004611686018427387904180Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational12883280WIN-5T344G8GM1HS-1-5-201/16/2018 6:27:14 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1288; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll585700004611686018427387904179Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational12884056WIN-5T344G8GM1HS-1-5-201/16/2018 6:27:14 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 652; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll585700004611686018427387904178Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6521972WIN-5T344G8GM1HS-1-5-181/16/2018 6:17:16 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
nettcpip provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4032; ProviderPath = %systemroot%\system32\wbem\NetTCPIP.dll585700004611686018427387904177Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational40323152WIN-5T344G8GM1HS-1-5-201/16/2018 6:17:14 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NetAdapterCim provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3688; ProviderPath = %systemroot%\system32\wbem\NetAdapterCim.dll585700004611686018427387904176Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational36883124WIN-5T344G8GM1HS-1-5-191/16/2018 6:17:14 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4032; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll585700004611686018427387904175Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational40321184WIN-5T344G8GM1HS-1-5-201/16/2018 6:17:14 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4032; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll585700004611686018427387904174Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational40321160WIN-5T344G8GM1HS-1-5-201/16/2018 6:17:14 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WMIProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1088; ProviderPath = %systemroot%\system32\wbem\wmiprov.dll585700004611686018427387904173Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational10884088WIN-5T344G8GM1HS-1-5-181/16/2018 6:10:25 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2784; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll585700004611686018427387904172Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational27841752WIN-5T344G8GM1HS-1-5-201/16/2018 6:08:29 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Namespace = //./root/CIMV2; NotificationQuery = select * from MSFT_SCMEventLogEvent; OwnerName = S-1-5-32-544; HostProcessID = 1176; Provider= SCM Event Provider, queryID = 0; PossibleCause = Permanent585900004611686018427387904171Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational11763928WIN-5T344G8GM1HS-1-5-181/16/2018 6:08:20 PMb65c0852-8ef4-0003-8709-5cb6f48ed301microsoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Namespace = //./root/subscription; Eventfilter = SCM Event Log Filter (refer to its activate eventid:5859); Consumer = NTEventLogEventConsumer="SCM Event Log Consumer"; PossibleCause = Binding EventFilter: instance of __EventFilter { CreatorSID = {1, 2, 0, 0, 0, 0, 0, 5, 32, 0, 0, 0, 32, 2, 0, 0}; EventNamespace = "root\\cimv2"; Name = "SCM Event Log Filter"; Query = "select * from MSFT_SCMEventLogEvent"; QueryLanguage = "WQL"; }; Perm. Consumer: instance of NTEventLogEventConsumer { Category = 0; CreatorSID = {1, 2, 0, 0, 0, 0, 0, 5, 32, 0, 0, 0, 32, 2, 0, 0}; EventType = 1; Name = "SCM Event Log Consumer"; NameOfUserSIDProperty = "sid"; SourceName = "Service Control Manager"; }; 586100004611686018427387904170Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational11763928WIN-5T344G8GM1HS-1-5-181/16/2018 6:08:20 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
MSVDS__PROVIDER provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2784; ProviderPath = %systemroot%\system32\wbem\vdswmi.dll585700004611686018427387904169Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational27841752WIN-5T344G8GM1HS-1-5-201/16/2018 6:07:37 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32a provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2784; ProviderPath = %systemroot%\system32\wbem\wmipcima.dll585700004611686018427387904168Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational27841752WIN-5T344G8GM1HS-1-5-201/16/2018 6:07:36 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
nettcpip provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2784; ProviderPath = %systemroot%\system32\wbem\NetTCPIP.dll585700004611686018427387904167Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational27844072WIN-5T344G8GM1HS-1-5-201/16/2018 6:07:14 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NetAdapterCim provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4076; ProviderPath = %systemroot%\system32\wbem\NetAdapterCim.dll585700004611686018427387904166Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational40761920WIN-5T344G8GM1HS-1-5-191/16/2018 6:07:14 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2784; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll585700004611686018427387904165Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational27844060WIN-5T344G8GM1HS-1-5-201/16/2018 6:07:14 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2784; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll585700004611686018427387904164Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational27842824WIN-5T344G8GM1HS-1-5-201/16/2018 6:07:14 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 2584; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\Microsoft\Windows\DeviceGuard : SELECT AvailableSecurityProperties FROM Win32_DeviceGuard ; ResultCode = 0x80041032; PossibleCause = Unknown585802004611686018427387904163Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational11762580WIN-5T344G8GM1HS-1-5-181/16/2018 6:06:34 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 2584; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\Microsoft\Windows\DeviceGuard : SELECT RequiredSecurityProperties FROM Win32_DeviceGuard ; ResultCode = 0x80041032; PossibleCause = Unknown585802004611686018427387904162Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational11762580WIN-5T344G8GM1HS-1-5-181/16/2018 6:06:34 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 2584; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\Microsoft\Windows\DeviceGuard : SELECT SecurityServicesConfigured FROM Win32_DeviceGuard ; ResultCode = 0x80041032; PossibleCause = Unknown585802004611686018427387904161Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational11762640WIN-5T344G8GM1HS-1-5-181/16/2018 6:06:34 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Win32_TpmProvider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2784; ProviderPath = C:\Windows\system32\wbem\Win32_TPM.dll585700004611686018427387904160Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational27842824WIN-5T344G8GM1HS-1-5-201/16/2018 6:06:34 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 2584; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\Microsoft\Windows\DeviceGuard : SELECT VirtualizationBasedSecurityStatus FROM Win32_DeviceGuard ; ResultCode = 0x80041032; PossibleCause = Unknown585802004611686018427387904159Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational11762640WIN-5T344G8GM1HS-1-5-181/16/2018 6:06:33 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 2584; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\Microsoft\Windows\DeviceGuard : SELECT SecurityServicesRunning FROM Win32_DeviceGuard ; ResultCode = 0x80041032; PossibleCause = Unknown585802004611686018427387904158Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational11762580WIN-5T344G8GM1HS-1-5-181/16/2018 6:06:33 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 2584; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\Microsoft\Windows\DeviceGuard : SELECT SecurityServicesRunning FROM Win32_DeviceGuard ; ResultCode = 0x80041032; PossibleCause = Unknown585802004611686018427387904157Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational11762580WIN-5T344G8GM1HS-1-5-181/16/2018 6:06:33 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 2584; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\Microsoft\Windows\DeviceGuard : SELECT AvailableSecurityProperties FROM Win32_DeviceGuard ; ResultCode = 0x80041032; PossibleCause = Unknown585802004611686018427387904156Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational11762580WIN-5T344G8GM1HS-1-5-181/16/2018 6:06:33 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 2584; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\Microsoft\Windows\DeviceGuard : SELECT RequiredSecurityProperties FROM Win32_DeviceGuard ; ResultCode = 0x80041032; PossibleCause = Unknown585802004611686018427387904155Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational11762580WIN-5T344G8GM1HS-1-5-181/16/2018 6:06:33 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Win32_DeviceGuard provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2784; ProviderPath = %SystemRoot%\System32\Win32_DeviceGuard.dll585700004611686018427387904154Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational27842824WIN-5T344G8GM1HS-1-5-201/16/2018 6:06:33 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 2584; Component = Unknown; Operation = Start IWbemServices::ExecQuery - ROOT\CIMV2 : select ChassisTypes from Win32_SystemEnclosure; ResultCode = 0x80041032; PossibleCause = Unknown585802004611686018427387904153Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational11762640WIN-5T344G8GM1HS-1-5-181/16/2018 6:06:33 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2784; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll585700004611686018427387904152Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational27842824WIN-5T344G8GM1HS-1-5-201/16/2018 6:06:32 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 2584; Component = Unknown; Operation = Start IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT ID FROM Win32_ServerFeature; ResultCode = 0x80041032; PossibleCause = Unknown585802004611686018427387904151Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational11762640WIN-5T344G8GM1HS-1-5-181/16/2018 6:06:32 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2832; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll585700004611686018427387904150Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational28322860WIN-5T344G8GM1HS-1-5-181/16/2018 6:06:27 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
ServerFeatureProvider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2784; ProviderPath = %windir%\system32\wbem\servercompprov.dll585700004611686018427387904149Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational27842812WIN-5T344G8GM1HS-1-5-201/16/2018 6:06:27 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4892; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll585700004611686018427387904148Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational4892836WIN-5T344G8GM1HS-1-5-201/16/2018 6:02:36 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4256; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll585700004611686018427387904147Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational42564144WIN-5T344G8GM1HS-1-5-181/16/2018 5:53:30 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
nettcpip provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4976; ProviderPath = %systemroot%\system32\wbem\NetTCPIP.dll585700004611686018427387904146Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational49763800WIN-5T344G8GM1HS-1-5-201/16/2018 5:53:24 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NetAdapterCim provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 5092; ProviderPath = %systemroot%\system32\wbem\NetAdapterCim.dll585700004611686018427387904145Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational50922628WIN-5T344G8GM1HS-1-5-191/16/2018 5:53:24 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4976; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll585700004611686018427387904144Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational49763800WIN-5T344G8GM1HS-1-5-201/16/2018 5:53:23 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4976; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll585700004611686018427387904143Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational49765116WIN-5T344G8GM1HS-1-5-201/16/2018 5:53:23 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {53B2B737-8EF1-0000-6DB9-B253F18ED301}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 1152; Component = Unknown; Operation = Start IWbemServices::ExecNotificationQuery - ROOT\CIMV2 : SELECT * FROM Win32_ProcessStartTrace WHERE ProcessName = 'wsmprovhost.exe'; ResultCode = 0x80041032; PossibleCause = Unknown585802004611686018427387904142Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational11524780WIN-5T344G8GM1HS-1-5-181/16/2018 5:50:11 PM53b2b737-8ef1-0000-6db9-b253f18ed301microsoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WMIProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3688; ProviderPath = %systemroot%\system32\wbem\wmiprov.dll585700004611686018427387904141Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational36882160WIN-5T344G8GM1HS-1-5-181/16/2018 5:46:15 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Namespace = ROOT\CIMV2; NotificationQuery = SELECT * FROM Win32_ProcessStartTrace WHERE ProcessName = 'wsmprovhost.exe'; UserName = ; ClientProcessID = 1152, ClientMachine = WIN-5T344G8GM1H; PossibleCause = Temporary586000004611686018427387904140Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational11524676WIN-5T344G8GM1HS-1-5-181/16/2018 5:44:23 PM53b2b737-8ef1-0003-feb9-b253f18ed301microsoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WMI Kernel Trace Event Provider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1152; ProviderPath = C:\Windows\System32\wbem\krnlprov.dll585700004611686018427387904139Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational11524676WIN-5T344G8GM1HS-1-5-181/16/2018 5:44:23 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 400; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_ComputerSystemProduct; ResultCode = 0x80041032; PossibleCause = Unknown585802004611686018427387904138Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational11522600WIN-5T344G8GM1HS-1-5-181/16/2018 5:44:12 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4212; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll585700004611686018427387904137Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational42124236WIN-5T344G8GM1HS-1-5-181/16/2018 5:43:31 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
MSVDS__PROVIDER provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 976; ProviderPath = %systemroot%\system32\wbem\vdswmi.dll585700004611686018427387904136Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9762796WIN-5T344G8GM1HS-1-5-201/16/2018 5:43:29 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
nettcpip provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 976; ProviderPath = %systemroot%\system32\wbem\NetTCPIP.dll585700004611686018427387904135Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9763216WIN-5T344G8GM1HS-1-5-201/16/2018 5:43:23 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NetAdapterCim provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3208; ProviderPath = %systemroot%\system32\wbem\NetAdapterCim.dll585700004611686018427387904134Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational32083308WIN-5T344G8GM1HS-1-5-191/16/2018 5:43:23 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 976; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll585700004611686018427387904133Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational976324WIN-5T344G8GM1HS-1-5-201/16/2018 5:43:23 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32a provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 976; ProviderPath = %systemroot%\system32\wbem\wmipcima.dll585700004611686018427387904132Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational976324WIN-5T344G8GM1HS-1-5-201/16/2018 5:43:17 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 976; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll585700004611686018427387904131Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational976324WIN-5T344G8GM1HS-1-5-201/16/2018 5:43:17 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Namespace = //./root/CIMV2; NotificationQuery = select * from MSFT_SCMEventLogEvent; OwnerName = S-1-5-32-544; HostProcessID = 1152; Provider= SCM Event Provider, queryID = 0; PossibleCause = Permanent585900004611686018427387904130Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational11522720WIN-5T344G8GM1HS-1-5-181/16/2018 5:42:38 PM53b2b737-8ef1-0001-8eb7-b253f18ed301microsoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Namespace = //./root/subscription; Eventfilter = SCM Event Log Filter (refer to its activate eventid:5859); Consumer = NTEventLogEventConsumer="SCM Event Log Consumer"; PossibleCause = Binding EventFilter: instance of __EventFilter { CreatorSID = {1, 2, 0, 0, 0, 0, 0, 5, 32, 0, 0, 0, 32, 2, 0, 0}; EventNamespace = "root\\cimv2"; Name = "SCM Event Log Filter"; Query = "select * from MSFT_SCMEventLogEvent"; QueryLanguage = "WQL"; }; Perm. Consumer: instance of NTEventLogEventConsumer { Category = 0; CreatorSID = {1, 2, 0, 0, 0, 0, 0, 5, 32, 0, 0, 0, 32, 2, 0, 0}; EventType = 1; Name = "SCM Event Log Consumer"; NameOfUserSIDProperty = "sid"; SourceName = "Service Control Manager"; }; 586100004611686018427387904129Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational11522720WIN-5T344G8GM1HS-1-5-181/16/2018 5:42:38 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {A4626349-8EA8-0003-B36D-62A4A88ED301}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::ExecNotificationQuery - ROOT\CIMV2 : SELECT * FROM Win32_ProcessStartTrace WHERE ProcessName = 'wsmprovhost.exe'; ResultCode = 0x80041032; PossibleCause = Unknown585802004611686018427387904128Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9243696WIN-5T344G8GM1HS-1-5-181/16/2018 5:37:24 PMa4626349-8ea8-0003-b36d-62a4a88ed301microsoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 164; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll585700004611686018427387904127Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational1643628WIN-5T344G8GM1HS-1-5-201/16/2018 5:35:48 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WmiPerfInst provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3868; ProviderPath = C:\Windows\System32\wbem\WmiPerfInst.dll585700004611686018427387904126Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational38681388WIN-5T344G8GM1HS-1-5-191/16/2018 5:35:07 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WMIProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4924; ProviderPath = %systemroot%\system32\wbem\wmiprov.dll585700004611686018427387904125Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational4924428WIN-5T344G8GM1HS-1-5-181/16/2018 5:35:04 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WmiPerfClass provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4924; ProviderPath = C:\Windows\System32\wbem\WmiPerfClass.dll585700004611686018427387904124Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational49245928WIN-5T344G8GM1HS-1-5-181/16/2018 5:35:03 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Namespace = ROOT\CIMV2; NotificationQuery = SELECT * FROM Win32_ProcessStartTrace WHERE ProcessName = 'wsmprovhost.exe'; UserName = ; ClientProcessID = 924, ClientMachine = WIN-5T344G8GM1H; PossibleCause = Temporary586000004611686018427387904123Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242052WIN-5T344G8GM1HS-1-5-181/16/2018 5:34:06 PMa4626349-8ea8-0002-ed6e-62a4a88ed301microsoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WMI Kernel Trace Event Provider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 924; ProviderPath = C:\Windows\System32\wbem\krnlprov.dll585700004611686018427387904122Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242052WIN-5T344G8GM1HS-1-5-181/16/2018 5:34:06 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 5028; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll585700004611686018427387904121Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational50285328WIN-5T344G8GM1HS-1-5-181/16/2018 5:32:53 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
nettcpip provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 5804; ProviderPath = %systemroot%\system32\wbem\NetTCPIP.dll585700004611686018427387904120Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational58045824WIN-5T344G8GM1HS-1-5-201/16/2018 5:32:40 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NetAdapterCim provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3816; ProviderPath = %systemroot%\system32\wbem\NetAdapterCim.dll585700004611686018427387904119Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational38161224WIN-5T344G8GM1HS-1-5-191/16/2018 5:32:40 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 5804; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll585700004611686018427387904118Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational58045824WIN-5T344G8GM1HS-1-5-201/16/2018 5:32:40 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 5804; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll585700004611686018427387904117Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5804912WIN-5T344G8GM1HS-1-5-201/16/2018 5:32:40 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3180; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll585700004611686018427387904116Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational3180804WIN-5T344G8GM1HS-1-5-181/16/2018 5:22:47 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
nettcpip provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3772; ProviderPath = %systemroot%\system32\wbem\NetTCPIP.dll585700004611686018427387904115Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational37725300WIN-5T344G8GM1HS-1-5-201/16/2018 5:22:40 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NetAdapterCim provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 888; ProviderPath = %systemroot%\system32\wbem\NetAdapterCim.dll585700004611686018427387904114Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational8885288WIN-5T344G8GM1HS-1-5-191/16/2018 5:22:40 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3772; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll585700004611686018427387904113Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational37725300WIN-5T344G8GM1HS-1-5-201/16/2018 5:22:40 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3772; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll585700004611686018427387904112Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational37723704WIN-5T344G8GM1HS-1-5-201/16/2018 5:22:40 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 5964; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll585700004611686018427387904111Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational59643468WIN-5T344G8GM1HS-1-5-181/16/2018 5:12:54 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {A4626349-8EA8-0000-8A6D-62A4A88ED301}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::ExecNotificationQuery - ROOT\CIMV2 : SELECT * FROM Win32_ProcessStartTrace WHERE ProcessName = 'wsmprovhost.exe'; ResultCode = 0x80041032; PossibleCause = Unknown585802004611686018427387904110Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9241992WIN-5T344G8GM1HS-1-5-181/16/2018 5:12:41 PMa4626349-8ea8-0000-8a6d-62a4a88ed301microsoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
nettcpip provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1260; ProviderPath = %systemroot%\system32\wbem\NetTCPIP.dll585700004611686018427387904109Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational12601960WIN-5T344G8GM1HS-1-5-201/16/2018 5:12:40 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NetAdapterCim provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2736; ProviderPath = %systemroot%\system32\wbem\NetAdapterCim.dll585700004611686018427387904108Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational27362320WIN-5T344G8GM1HS-1-5-191/16/2018 5:12:40 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1260; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll585700004611686018427387904107Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational12601960WIN-5T344G8GM1HS-1-5-201/16/2018 5:12:40 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1260; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll585700004611686018427387904106Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational12601936WIN-5T344G8GM1HS-1-5-201/16/2018 5:12:40 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Namespace = ROOT\CIMV2; NotificationQuery = SELECT * FROM Win32_ProcessStartTrace WHERE ProcessName = 'wsmprovhost.exe'; UserName = ; ClientProcessID = 924, ClientMachine = WIN-5T344G8GM1H; PossibleCause = Temporary586000004611686018427387904105Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9243016WIN-5T344G8GM1HS-1-5-181/16/2018 5:06:17 PMa4626349-8ea8-0003-146c-62a4a88ed301microsoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WMI Kernel Trace Event Provider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 924; ProviderPath = C:\Windows\System32\wbem\krnlprov.dll585700004611686018427387904104Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9243016WIN-5T344G8GM1HS-1-5-181/16/2018 5:06:17 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
MSVDS__PROVIDER provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3428; ProviderPath = %systemroot%\system32\wbem\vdswmi.dll585700004611686018427387904103Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational34285844WIN-5T344G8GM1HS-1-5-201/16/2018 5:06:06 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3428; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll585700004611686018427387904102Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational34285844WIN-5T344G8GM1HS-1-5-201/16/2018 5:06:06 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WMIProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2768; ProviderPath = %systemroot%\system32\wbem\wmiprov.dll585700004611686018427387904101Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational27681104WIN-5T344G8GM1HS-1-5-181/16/2018 5:05:59 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2856; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll585700004611686018427387904100Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational28563704WIN-5T344G8GM1HS-1-5-201/16/2018 5:04:01 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Namespace = //./root/CIMV2; NotificationQuery = select * from MSFT_SCMEventLogEvent; OwnerName = S-1-5-32-544; HostProcessID = 924; Provider= SCM Event Provider, queryID = 0; PossibleCause = Permanent58590000461168601842738790499Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9243356WIN-5T344G8GM1HS-1-5-181/16/2018 5:03:48 PMa4626349-8ea8-0003-c36b-62a4a88ed301microsoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Namespace = //./root/subscription; Eventfilter = SCM Event Log Filter (refer to its activate eventid:5859); Consumer = NTEventLogEventConsumer="SCM Event Log Consumer"; PossibleCause = Binding EventFilter: instance of __EventFilter { CreatorSID = {1, 2, 0, 0, 0, 0, 0, 5, 32, 0, 0, 0, 32, 2, 0, 0}; EventNamespace = "root\\cimv2"; Name = "SCM Event Log Filter"; Query = "select * from MSFT_SCMEventLogEvent"; QueryLanguage = "WQL"; }; Perm. Consumer: instance of NTEventLogEventConsumer { Category = 0; CreatorSID = {1, 2, 0, 0, 0, 0, 0, 5, 32, 0, 0, 0, 32, 2, 0, 0}; EventType = 1; Name = "SCM Event Log Consumer"; NameOfUserSIDProperty = "sid"; SourceName = "Service Control Manager"; }; 58610000461168601842738790498Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9241768WIN-5T344G8GM1HS-1-5-181/16/2018 5:03:48 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
MSVDS__PROVIDER provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2856; ProviderPath = %systemroot%\system32\wbem\vdswmi.dll58570000461168601842738790497Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational28563704WIN-5T344G8GM1HS-1-5-201/16/2018 5:02:51 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
nettcpip provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2856; ProviderPath = %systemroot%\system32\wbem\NetTCPIP.dll58570000461168601842738790496Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational2856812WIN-5T344G8GM1HS-1-5-201/16/2018 5:02:39 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NetAdapterCim provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 5960; ProviderPath = %systemroot%\system32\wbem\NetAdapterCim.dll58570000461168601842738790495Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational59605988WIN-5T344G8GM1HS-1-5-191/16/2018 5:02:39 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2856; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll58570000461168601842738790494Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational28563084WIN-5T344G8GM1HS-1-5-201/16/2018 5:02:39 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 2972; Component = Unknown; Operation = Start IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT ID FROM Win32_ServerFeature; ResultCode = 0x80041032; PossibleCause = Unknown58580200461168601842738790493Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242352WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:13 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{FB2CA36D-0B40-4307-821B-A13B252DE56C}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790492Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242512WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:11 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{F9C77450-3A41-477E-9310-9ACD617BD9E3}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790491Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242512WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:11 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{E62688F0-25FD-4c90-BFF5-F508B9D2E31F}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790490Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242512WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:11 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{E5094040-C46C-4115-B030-04FB2E545B00}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790489Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242512WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:11 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{E4F48E54-F38D-4884-BFB9-D4D2E5729C18}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790488Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242512WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:11 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{E47248BA-94CC-49c4-BBB5-9EB7F05183D0}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790487Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242512WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:11 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{CF7639F3-ABA2-41DB-97F2-81E2C5DBFC5D}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790486Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242512WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:11 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{c6dc5466-785a-11d2-84d0-00c04fb169f7}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790485Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242512WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:11 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{C631DF4C-088F-4156-B058-4375F0853CD8}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790484Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242512WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:11 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{C418DD9D-0D14-4efb-8FBF-CFE535C8FAC7}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790483Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242512WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:11 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{C34B2751-1CF4-44F5-9262-C3FC39666591}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790482Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242512WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:11 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{BC75B1ED-5833-4858-9BB8-CBF0B166DF9D}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790481Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242512WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:11 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{BA649533-0AAC-4E04-B9BC-4DBAE0325B12}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790480Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242512WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:11 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{B087BE9D-ED37-454f-AF9C-04291E351182}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790479Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242512WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:11 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{AADCED64-746C-4633-A97C-D61349046527}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790478Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242512WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:11 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{A3F3E39B-5D83-4940-B954-28315B82F0A8}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790477Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242512WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:11 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{91FBB303-0CD5-4055-BF42-E512A681B325}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790476Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242512WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:11 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{8A28E2C5-8D06-49A4-A08C-632DAA493E17}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790475Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242512WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:11 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{7B849a69-220F-451E-B3FE-2CB811AF94AE}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790474Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242512WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:11 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{7933F41E-56F8-41d6-A31C-4148A711EE93}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790473Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242512WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:11 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{74EE6C03-5363-4554-B161-627540339CAB}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790472Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242512WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:11 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{728EE579-943C-4519-9EF7-AB56765798ED}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790471Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242512WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:11 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{7150F9BF-48AD-4da4-A49C-29EF4A8369BA}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790470Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242512WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:11 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{6232C319-91AC-4931-9385-E70C2B099F0E}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790469Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242512WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:11 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{5794DAFD-BE60-433f-88A2-1A31939AC01F}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790468Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242512WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:11 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{4D2F9B6F-1E52-4711-A382-6A8B1A003DE6}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790467Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242512WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:11 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{4CFB60C1-FAA6-47f1-89AA-0B18730C9FD3}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790466Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242512WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:11 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{4B7C3B0F-E993-4E06-A241-3FBE06943684}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790465Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242512WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:11 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{42B5FAAE-6536-11d2-AE5A-0000F87571E3}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790464Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242512WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:11 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{3A0DBA37-F8B2-4356-83DE-3E90BD5C261F}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790463Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242512WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:11 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{2BFCC077-22D2-48DE-BDE1-2F618D9B476D}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790462Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242512WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:11 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{25537BA6-77A8-11D2-9B6C-0000F8080861}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790461Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242512WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:11 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{1A6364EB-776B-4120-ADE1-B63A406A76B5}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790460Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242512WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:11 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{17D89FEC-5C44-4972-B12D-241CAEF74509}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790459Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242512WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:11 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{169EBF44-942F-4C43-87CE-13C93996EBBE}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790458Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242512WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:11 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{0E28E245-9368-4853-AD84-6DA3BA35BB75}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790457Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242512WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:11 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WMIProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2768; ProviderPath = %systemroot%\system32\wbem\wmiprov.dll58570000461168601842738790456Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational27681124WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:11 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WMIProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2768; ProviderPath = %systemroot%\system32\wbem\wmiprov.dll58570000461168601842738790455Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational27681124WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:11 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{FC491EF1-C4AA-4CE1-B329-414B101DB823}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790454Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242528WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:09 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{fbf687e6-f063-4d9f-9f4f-fd9a26acdd5f}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790453Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242528WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:09 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{FB2CA36D-0B40-4307-821B-A13B252DE56C}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790452Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242528WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:09 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{f3ccc681-b74c-4060-9f26-cd84525dca2a}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790451Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242528WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:09 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{F312195E-3D9D-447A-A3F5-08DFFA24735E}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790450Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242528WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:09 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{E62688F0-25FD-4c90-BFF5-F508B9D2E31F}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790449Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242528WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:09 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{E5094040-C46C-4115-B030-04FB2E545B00}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790448Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242528WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:09 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{E4F48E54-F38D-4884-BFB9-D4D2E5729C18}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790447Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242528WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:09 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{e437bc1c-aa7d-11d2-a382-00c04f991e27}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790446Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242528WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:09 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{CF7639F3-ABA2-41DB-97F2-81E2C5DBFC5D}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790445Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242528WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:09 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{cdeafc3d-948d-49dd-ab12-e578ba4af7aa}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790444Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242528WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:09 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{c6dc5466-785a-11d2-84d0-00c04fb169f7}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790443Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242528WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:09 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{C631DF4C-088F-4156-B058-4375F0853CD8}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790442Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242528WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:09 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{C418DD9D-0D14-4efb-8FBF-CFE535C8FAC7}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790441Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242528WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:09 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{C34B2751-1CF4-44F5-9262-C3FC39666591}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790440Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242528WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:09 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{BC75B1ED-5833-4858-9BB8-CBF0B166DF9D}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790439Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242528WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:09 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{BA649533-0AAC-4E04-B9BC-4DBAE0325B12}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790438Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242528WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:09 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{B587E2B1-4D59-4e7e-AED9-22B9DF11D053}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790437Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242528WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:09 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{B087BE9D-ED37-454f-AF9C-04291E351182}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790436Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242528WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:09 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{AADCED64-746C-4633-A97C-D61349046527}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790435Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242528WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:09 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{A3F3E39B-5D83-4940-B954-28315B82F0A8}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790434Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242528WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:09 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{91FBB303-0CD5-4055-BF42-E512A681B325}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790433Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242528WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:09 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{8A28E2C5-8D06-49A4-A08C-632DAA493E17}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790432Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242528WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:09 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{827D319E-6EAC-11D2-A4EA-00C04F79F83A}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790431Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242528WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:09 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{7B849a69-220F-451E-B3FE-2CB811AF94AE}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790430Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242528WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:09 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{7933F41E-56F8-41d6-A31C-4148A711EE93}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790429Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242528WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:09 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{74EE6C03-5363-4554-B161-627540339CAB}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790428Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242528WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:09 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{728EE579-943C-4519-9EF7-AB56765798ED}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790427Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242528WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:09 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{7150F9BF-48AD-4da4-A49C-29EF4A8369BA}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790426Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242528WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:09 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{6A4C88C6-C502-4f74-8F60-2CB23EDC24E2}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790425Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242528WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:09 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{6232C319-91AC-4931-9385-E70C2B099F0E}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790424Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242528WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:09 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{4CFB60C1-FAA6-47f1-89AA-0B18730C9FD3}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790423Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242528WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:09 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{4bcd6cde-777b-48b6-9804-43568e23545d}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790422Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242528WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:09 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{4B7C3B0F-E993-4E06-A241-3FBE06943684}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790421Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242528WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:09 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{42B5FAAE-6536-11d2-AE5A-0000F87571E3}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790420Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242528WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:09 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{426031c0-0b47-4852-b0ca-ac3d37bfcb39}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790419Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242528WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:09 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{3A0DBA37-F8B2-4356-83DE-3E90BD5C261F}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790418Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242528WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:09 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{3610eda5-77ef-11d2-8dc5-00c04fa31a66}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790417Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242528WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:09 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{2BFCC077-22D2-48DE-BDE1-2F618D9B476D}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790416Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242528WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:09 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{2A8FDC61-2347-4C87-92F6-B05EB91A201A}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790415Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242528WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:09 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{1A6364EB-776B-4120-ADE1-B63A406A76B5}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790414Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242528WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:09 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{17D89FEC-5C44-4972-B12D-241CAEF74509}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790413Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242528WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:09 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{16be69fa-4209-4250-88cb-716cf41954e0}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790412Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242528WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:09 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{169EBF44-942F-4C43-87CE-13C93996EBBE}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790411Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242528WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:09 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{0E28E245-9368-4853-AD84-6DA3BA35BB75}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790410Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242528WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:09 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{0ACDD40C-75AC-47ab-BAA0-BF6DE7E7FE63}"; ResultCode = 0x80041002; PossibleCause = Unknown5858020046116860184273879049Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242528WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:09 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{35378EAC-683F-11D2-A89A-00C04FBBCFA2}"; ResultCode = 0x80041002; PossibleCause = Unknown5858020046116860184273879048Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242528WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:09 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3440; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll5857000046116860184273879047Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational34403468WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:09 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
ServerFeatureProvider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2856; ProviderPath = %windir%\system32\wbem\servercompprov.dll5857000046116860184273879046Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational28563084WIN-5T344G8GM1HS-1-5-201/16/2018 5:02:09 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 2972; Component = Unknown; Operation = Start IWbemServices::ExecQuery - ROOT\CIMV2 : select ChassisTypes from Win32_SystemEnclosure; ResultCode = 0x80041032; PossibleCause = Unknown5858020046116860184273879045Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242484WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:09 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32a provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2856; ProviderPath = %systemroot%\system32\wbem\wmipcima.dll5857000046116860184273879044Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational28563084WIN-5T344G8GM1HS-1-5-201/16/2018 5:02:06 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2856; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll5857000046116860184273879043Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational28562436WIN-5T344G8GM1HS-1-5-201/16/2018 5:02:05 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-PD8DQPRRTAO; User = NT AUTHORITY\SYSTEM; ClientProcessId = 2508; Component = Unknown; Operation = Start IWbemServices::CreateInstanceEnum - root\wmi : MSiSCSI_PortalInfoClass; ResultCode = 0x8004100A; PossibleCause = Unknown5858020046116860184273879042Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9162392WIN-PD8DQPRRTAOS-1-5-181/16/2018 5:01:40 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-PD8DQPRRTAO; User = NT AUTHORITY\SYSTEM; ClientProcessId = 2508; Component = Unknown; Operation = Start IWbemServices::CreateInstanceEnum - root\wmi : MS_SM_AdapterInformationQuery; ResultCode = 0x8004100A; PossibleCause = Unknown5858020046116860184273879041Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9162392WIN-PD8DQPRRTAOS-1-5-181/16/2018 5:01:40 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]