Message	Id	Level	Keywords	RecordId	ProviderName	ProviderId	LogName	ProcessId	ThreadId	MachineName	UserId	TimeCreated	ActivityId	ContainerLog	MatchedQueryIds	Bookmark	LevelDisplayName	OpcodeDisplayName	KeywordsDisplayNames	Properties
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1668; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll	5857	0	4611686018427387904	834	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	1668	4424	hv-cinder-83538	S-1-5-20	6/21/2022 9:09:09 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2316; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll	5857	0	4611686018427387904	833	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2316	4528	hv-cinder-83538	S-1-5-18	6/21/2022 9:07:17 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1668; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll	5857	0	4611686018427387904	832	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	1668	3836	hv-cinder-83538	S-1-5-20	6/21/2022 9:07:17 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {50A50148-374E-4E53-BD08-4C034DCF209E}; ClientMachine = HV-CINDER-83538; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1632; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=962302285; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	831	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	556	796	hv-cinder-83538	S-1-5-18	6/21/2022 9:06:57 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {36B03930-0A89-4DC8-86CB-DBE556E8F1D3}; ClientMachine = HV-CINDER-83538; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1632; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Host.HostName="iqn.2010-10.org.openstack:volume-603b0647-1749-4ddc-9117-7325cafe0995"; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	830	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	556	536	hv-cinder-83538	S-1-5-18	6/21/2022 9:06:56 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {E7D459B7-5564-43BB-8FA8-722695B45CA0}; ClientMachine = HV-CINDER-83538; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1632; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_IDMethod.HostName="iqn.2010-10.org.openstack:volume-603b0647-1749-4ddc-9117-7325cafe0995",Method=4,Value="iqn.1991-05.com.microsoft:hv-cinder-83538"; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	829	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	556	796	hv-cinder-83538	S-1-5-18	6/21/2022 9:06:56 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {CACFCE6F-C388-4E02-8CE8-D4E458B8BD91}; ClientMachine = HV-CINDER-83538; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1632; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{3B660F1A-B1BA-48DB-99C3-F4124DAEA85D}"; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	828	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	556	1468	hv-cinder-83538	S-1-5-18	6/21/2022 9:06:51 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {C6A084CC-0F6F-4286-88D4-9D265E57FB2D}; ClientMachine = HV-CINDER-83538; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1632; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1685479084; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	827	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	556	4236	hv-cinder-83538	S-1-5-18	6/21/2022 9:06:50 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {0F1FC12E-FE61-437B-9CA7-C466E3D2C66E}; ClientMachine = HV-CINDER-83538; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1632; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Host.HostName="iqn.2010-10.org.openstack:volume-08eb63d2-355f-4925-b994-fe78031df24e"; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	826	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	556	4236	hv-cinder-83538	S-1-5-18	6/21/2022 9:06:49 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {03DC5929-DAB2-4F3C-A18B-152ADBEA3903}; ClientMachine = HV-CINDER-83538; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1632; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_IDMethod.HostName="iqn.2010-10.org.openstack:volume-08eb63d2-355f-4925-b994-fe78031df24e",Method=4,Value="iqn.1991-05.com.microsoft:hv-cinder-83538"; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	825	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	556	1468	hv-cinder-83538	S-1-5-18	6/21/2022 9:06:49 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WinTargetProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1060; ProviderPath = C:\windows\system32\wbem\WTWMIProv.dll	5857	0	4611686018427387904	824	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	1060	732	hv-cinder-83538	S-1-5-19	6/21/2022 9:06:49 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
StorageWMI provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1668; ProviderPath = %SystemRoot%\System32\storagewmi.dll	5857	0	4611686018427387904	823	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	1668	3836	hv-cinder-83538	S-1-5-20	6/21/2022 9:06:48 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1668; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll	5857	0	4611686018427387904	822	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	1668	3836	hv-cinder-83538	S-1-5-20	6/21/2022 9:06:09 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
MSVSS__PROVIDER provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1668; ProviderPath = %systemroot%\system32\wbem\vsswmi.dll	5857	0	4611686018427387904	821	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	1668	3836	hv-cinder-83538	S-1-5-20	6/21/2022 9:04:36 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {BC1E89D2-153D-4338-A18C-CB50B16CC4F4}; ClientMachine = HV-CINDER-83538; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1632; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1807765095; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	820	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	556	1316	hv-cinder-83538	S-1-5-18	6/21/2022 9:04:34 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {294004CB-381E-4177-8182-C7282DD74393}; ClientMachine = HV-CINDER-83538; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1632; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1648432426; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	819	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	556	1316	hv-cinder-83538	S-1-5-18	6/21/2022 9:04:19 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {0FF95A5E-4813-488B-A1FA-8153466CC1A0}; ClientMachine = HV-CINDER-83538; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1632; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Host.HostName="iqn.2010-10.org.openstack:volume-b0608fac-6e8b-4e92-ac7c-499f3fbda46b"; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	818	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	556	1316	hv-cinder-83538	S-1-5-18	6/21/2022 9:04:19 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9D3A7F05-EA89-4C1C-98A2-5E2E161853CB}; ClientMachine = HV-CINDER-83538; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1632; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_IDMethod.HostName="iqn.2010-10.org.openstack:volume-b0608fac-6e8b-4e92-ac7c-499f3fbda46b",Method=4,Value="iqn.1991-05.com.microsoft:hv-cinder-83538"; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	817	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	556	1316	hv-cinder-83538	S-1-5-18	6/21/2022 9:04:19 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WinTargetProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4940; ProviderPath = C:\windows\system32\wbem\WTWMIProv.dll	5857	0	4611686018427387904	816	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	4940	3644	hv-cinder-83538	S-1-5-19	6/21/2022 9:04:19 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
StorageWMI provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1668; ProviderPath = %SystemRoot%\System32\storagewmi.dll	5857	0	4611686018427387904	815	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	1668	3836	hv-cinder-83538	S-1-5-20	6/21/2022 9:04:18 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1668; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll	5857	0	4611686018427387904	814	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	1668	3836	hv-cinder-83538	S-1-5-20	6/21/2022 9:04:08 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {2B9DCFEC-FF88-470D-A6DA-33F58BA14699}; ClientMachine = HV-CINDER-83538; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1632; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Host.HostName="iqn.2010-10.org.openstack:volume-b0608fac-6e8b-4e92-ac7c-499f3fbda46b"; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	813	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	556	1316	hv-cinder-83538	S-1-5-18	6/21/2022 9:02:33 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {7A1273A6-7B0C-476D-B47A-7B5102A157E0}; ClientMachine = HV-CINDER-83538; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1632; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_IDMethod.HostName="iqn.2010-10.org.openstack:volume-b0608fac-6e8b-4e92-ac7c-499f3fbda46b",Method=4,Value="iqn.1991-05.com.microsoft:hv-cinder-83538"; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	812	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	556	1316	hv-cinder-83538	S-1-5-18	6/21/2022 9:02:33 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1668; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll	5857	0	4611686018427387904	811	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	1668	3836	hv-cinder-83538	S-1-5-20	6/21/2022 9:02:04 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {E25F4A16-FDA1-4300-9D3B-28289A3BC65C}; ClientMachine = HV-CINDER-83538; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1632; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Host.HostName="iqn.2010-10.org.openstack:volume-603b0647-1749-4ddc-9117-7325cafe0995"; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	810	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	556	1468	hv-cinder-83538	S-1-5-18	6/21/2022 9:02:04 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {7363355C-0522-40ED-B396-D8DC12306BD7}; ClientMachine = HV-CINDER-83538; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1632; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_IDMethod.HostName="iqn.2010-10.org.openstack:volume-603b0647-1749-4ddc-9117-7325cafe0995",Method=4,Value="iqn.1991-05.com.microsoft:hv-cinder-83538"; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	809	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	556	1316	hv-cinder-83538	S-1-5-18	6/21/2022 9:02:04 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WinTargetProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1168; ProviderPath = C:\windows\system32\wbem\WTWMIProv.dll	5857	0	4611686018427387904	808	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	1168	5080	hv-cinder-83538	S-1-5-19	6/21/2022 9:02:04 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
StorageWMI provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1668; ProviderPath = %SystemRoot%\System32\storagewmi.dll	5857	0	4611686018427387904	807	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	1668	3836	hv-cinder-83538	S-1-5-20	6/21/2022 9:02:02 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1668; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll	5857	0	4611686018427387904	806	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	1668	3836	hv-cinder-83538	S-1-5-20	6/21/2022 9:01:02 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {E954A10C-8FD3-488C-A04E-54B91C94C8AD}; ClientMachine = HV-CINDER-83538; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1632; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=849107626; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	805	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	556	1468	hv-cinder-83538	S-1-5-18	6/21/2022 8:59:35 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {05C860E0-2FE0-4472-B644-52EBD267939E}; ClientMachine = HV-CINDER-83538; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1632; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{48C80F70-2330-4F3F-9C36-716C33506331}"; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	804	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	556	4928	hv-cinder-83538	S-1-5-18	6/21/2022 8:59:33 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {08FB857A-70DD-4801-9E70-228DB44CA641}; ClientMachine = HV-CINDER-83538; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1632; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{A60AAC78-662B-4586-B1AF-A99C850B39AD}"; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	803	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	556	1316	hv-cinder-83538	S-1-5-18	6/21/2022 8:59:32 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {2E7FE8A6-B560-40C8-8F12-BE4E1B4A216E}; ClientMachine = HV-CINDER-83538; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1632; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{DC6ABE29-F8E8-4878-9B0B-F9B664BCE09E}"; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	802	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	556	1316	hv-cinder-83538	S-1-5-18	6/21/2022 8:59:31 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {D1EC777C-CF6E-4055-BA3C-534CD4F87856}; ClientMachine = HV-CINDER-83538; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1632; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=62819542; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	801	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	556	4236	hv-cinder-83538	S-1-5-18	6/21/2022 8:59:06 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {D82D5C56-78C6-4A3F-B77B-EBDEA427C9AF}; ClientMachine = HV-CINDER-83538; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1632; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=852251746; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	800	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	556	1468	hv-cinder-83538	S-1-5-18	6/21/2022 8:59:03 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FC821443-77B2-4F7F-826E-A789706800EF}; ClientMachine = HV-CINDER-83538; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1632; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1385622317; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	799	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	556	1468	hv-cinder-83538	S-1-5-18	6/21/2022 8:59:02 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {016835B8-8B07-4351-8DB5-5E24C8B8D46A}; ClientMachine = HV-CINDER-83538; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1632; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{FFAF3F15-2C1A-4831-B9EC-D1768CE44583}"; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	798	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	556	1648	hv-cinder-83538	S-1-5-18	6/21/2022 8:59:01 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
StorageWMI provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1668; ProviderPath = %SystemRoot%\System32\storagewmi.dll	5857	0	4611686018427387904	797	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	1668	3836	hv-cinder-83538	S-1-5-20	6/21/2022 8:58:59 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {F2DA994E-C7AD-485F-8FDE-5CECECB085B1}; ClientMachine = HV-CINDER-83538; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1632; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1088561707; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	796	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	556	4236	hv-cinder-83538	S-1-5-18	6/21/2022 8:58:36 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {130D060A-9116-487B-B851-2514E0925ED3}; ClientMachine = HV-CINDER-83538; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1632; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1806174610; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	795	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	556	1468	hv-cinder-83538	S-1-5-18	6/21/2022 8:58:34 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {6005D9DD-CEDE-4D41-BA38-B284A27DE825}; ClientMachine = HV-CINDER-83538; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1632; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1154946579; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	794	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	556	1468	hv-cinder-83538	S-1-5-18	6/21/2022 8:58:34 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {077AD0A4-02F7-4E45-A836-B3179F6E3E67}; ClientMachine = HV-CINDER-83538; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1632; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=289835831; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	793	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	556	4236	hv-cinder-83538	S-1-5-18	6/21/2022 8:58:32 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {A8417098-4DA1-4F98-B6C5-B2B4DDBF794A}; ClientMachine = HV-CINDER-83538; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1632; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=2199255; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	792	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	556	1468	hv-cinder-83538	S-1-5-18	6/21/2022 8:58:32 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD816D02-A99D-4F89-95CE-79C61AF42599}; ClientMachine = HV-CINDER-83538; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1632; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1508309464; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	791	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	556	1648	hv-cinder-83538	S-1-5-18	6/21/2022 8:58:24 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {5EBE292D-BC8F-4D76-AFC2-89D2EF9CA871}; ClientMachine = HV-CINDER-83538; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1632; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=443300336; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	790	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	556	1648	hv-cinder-83538	S-1-5-18	6/21/2022 8:58:16 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {DFB0580E-9658-4DF0-86FF-E5F41E393C51}; ClientMachine = HV-CINDER-83538; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1632; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=302451083; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	789	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	556	4236	hv-cinder-83538	S-1-5-18	6/21/2022 8:58:09 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {72EB5F58-4741-4723-B4C5-B9601DE5530D}; ClientMachine = HV-CINDER-83538; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1632; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=4714398; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	788	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	556	4236	hv-cinder-83538	S-1-5-18	6/21/2022 8:58:07 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {24B0D8FC-3DCF-4A56-9CAA-BFC31752D430}; ClientMachine = HV-CINDER-83538; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1632; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=822595439; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	787	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	556	1648	hv-cinder-83538	S-1-5-18	6/21/2022 8:58:06 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {D3F00417-5050-4AA6-ABC6-8D349AC9E8FD}; ClientMachine = HV-CINDER-83538; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1632; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{77FC2CA5-7E77-4BCF-AA1F-DEE4128A0F21}"; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	786	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	556	1648	hv-cinder-83538	S-1-5-18	6/21/2022 8:58:06 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {5F186B11-83D8-4E70-A857-D8E97B3F41E1}; ClientMachine = HV-CINDER-83538; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1632; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1656132868; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	785	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	556	1468	hv-cinder-83538	S-1-5-18	6/21/2022 8:58:05 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {15AAE176-FE78-41C5-B6F5-C0BA3CF76D1E}; ClientMachine = HV-CINDER-83538; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1632; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1163506518; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	784	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	556	4236	hv-cinder-83538	S-1-5-18	6/21/2022 8:58:05 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {1E4E202C-A406-4C36-9A43-04AB21E65C57}; ClientMachine = HV-CINDER-83538; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1632; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1691525565; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	783	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	556	840	hv-cinder-83538	S-1-5-18	6/21/2022 8:57:50 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {B557F18A-E29E-438E-BBC2-AF132EBC961A}; ClientMachine = HV-CINDER-83538; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1632; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=865729183; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	782	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	556	1468	hv-cinder-83538	S-1-5-18	6/21/2022 8:57:50 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {F0F43CFA-E939-4DB6-9989-1544E75B984D}; ClientMachine = HV-CINDER-83538; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1632; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{042822F5-C8FB-4ED9-BAE0-8311757899DB}"; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	781	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	556	1468	hv-cinder-83538	S-1-5-18	6/21/2022 8:57:49 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {D191657C-5EB7-4F6E-9223-E8ABB5D17BD0}; ClientMachine = HV-CINDER-83538; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1632; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{C5A700BD-B56B-41F5-851E-7E31CEDA81A3}"; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	780	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	556	1648	hv-cinder-83538	S-1-5-18	6/21/2022 8:57:49 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {208F76BF-07DC-4C89-BEAE-C6DF6A6D0B20}; ClientMachine = HV-CINDER-83538; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1632; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=689252210; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	779	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	556	796	hv-cinder-83538	S-1-5-18	6/21/2022 8:57:48 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {EE6806A6-61F3-4601-B300-E3976BEAE428}; ClientMachine = HV-CINDER-83538; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1632; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=802016785; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	778	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	556	4236	hv-cinder-83538	S-1-5-18	6/21/2022 8:57:42 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {2A4537E4-21B9-4379-95EE-D30F30AB754B}; ClientMachine = HV-CINDER-83538; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1632; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1404502315; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	777	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	556	4236	hv-cinder-83538	S-1-5-18	6/21/2022 8:57:42 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {65DB1C9E-6B6D-4678-A1D0-3B63D9E28D00}; ClientMachine = HV-CINDER-83538; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1632; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=2025892171; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	776	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	556	1648	hv-cinder-83538	S-1-5-18	6/21/2022 8:57:42 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32a provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1668; ProviderPath = %systemroot%\system32\wbem\wmipcima.dll	5857	0	4611686018427387904	775	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	1668	3836	hv-cinder-83538	S-1-5-20	6/21/2022 8:57:41 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {D4D389A3-AD58-4192-BEED-ADCF7D8F5CDA}; ClientMachine = HV-CINDER-83538; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1632; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1276012627; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	774	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	556	1648	hv-cinder-83538	S-1-5-18	6/21/2022 8:57:36 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {4CF61BAC-9E4C-4A1D-A0AB-A69751CE6CDF}; ClientMachine = HV-CINDER-83538; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1632; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{19096043-8958-4061-8649-DB7997E254CE}"; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	773	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	556	1648	hv-cinder-83538	S-1-5-18	6/21/2022 8:57:35 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {839E7554-B661-45BC-816D-30AC116CA969}; ClientMachine = HV-CINDER-83538; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1632; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1793318280; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	772	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	556	4236	hv-cinder-83538	S-1-5-18	6/21/2022 8:57:35 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {F2F9009A-E3B5-49E8-A589-D16F3E97DACD}; ClientMachine = HV-CINDER-83538; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1632; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=899007633; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	771	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	556	4236	hv-cinder-83538	S-1-5-18	6/21/2022 8:57:35 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {1C44CD60-F249-4959-97B3-625B56E24352}; ClientMachine = HV-CINDER-83538; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1632; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=799311578; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	770	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	556	4236	hv-cinder-83538	S-1-5-18	6/21/2022 8:57:35 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {956A6E86-35B4-4DAC-B235-578BB3EAA869}; ClientMachine = HV-CINDER-83538; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1632; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=396965728; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	769	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	556	796	hv-cinder-83538	S-1-5-18	6/21/2022 8:57:28 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {8557D6E7-28E4-428F-B627-9C082CD58B56}; ClientMachine = HV-CINDER-83538; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1632; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1989977899; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	768	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	556	4236	hv-cinder-83538	S-1-5-18	6/21/2022 8:57:27 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {66206C8B-45A9-44C9-AA3A-6B821F83CC47}; ClientMachine = HV-CINDER-83538; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1632; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{D4EA9FD6-2E12-4E0E-A7BB-E7766897074B}"; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	767	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	556	840	hv-cinder-83538	S-1-5-18	6/21/2022 8:57:27 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {7DAFE9AA-3582-4CF2-B9E5-C0FCAFAA8574}; ClientMachine = HV-CINDER-83538; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1632; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=338570577; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	766	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	556	4236	hv-cinder-83538	S-1-5-18	6/21/2022 8:57:26 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {55289014-A650-421E-AAE3-CDBAA8CFB1A3}; ClientMachine = HV-CINDER-83538; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1632; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1099003799; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	765	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	556	840	hv-cinder-83538	S-1-5-18	6/21/2022 8:57:26 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {EAEB34AA-F224-47CF-9621-A28966DFA84F}; ClientMachine = HV-CINDER-83538; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1632; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1211966746; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	764	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	556	840	hv-cinder-83538	S-1-5-18	6/21/2022 8:57:26 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {CB1D47C6-1B64-416B-8649-2496933EE594}; ClientMachine = HV-CINDER-83538; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1632; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Host.HostName="iqn.2010-10.org.openstack:volume-fb752723-7157-45f5-a768-96399e9f44bc"; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	763	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	556	840	hv-cinder-83538	S-1-5-18	6/21/2022 8:57:26 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {E2C95E9C-52C4-4AF3-901A-0D81A5C97DC5}; ClientMachine = HV-CINDER-83538; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1632; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_IDMethod.HostName="iqn.2010-10.org.openstack:volume-fb752723-7157-45f5-a768-96399e9f44bc",Method=4,Value="iqn.1991-05.com.microsoft:hv-cinder-83538"; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	762	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	556	4236	hv-cinder-83538	S-1-5-18	6/21/2022 8:57:20 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {813ED1AE-1077-449D-8D40-5AC5A85083E7}; ClientMachine = HV-CINDER-83538; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1632; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{7B4014E3-CEB6-4228-BA34-AF147212E7C9}"; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	761	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	556	840	hv-cinder-83538	S-1-5-18	6/21/2022 8:57:19 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {3FB0815E-4E28-425B-9944-46F2DDB3412C}; ClientMachine = HV-CINDER-83538; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1632; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=666593714; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	760	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	556	840	hv-cinder-83538	S-1-5-18	6/21/2022 8:57:19 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {6812B0C8-5154-4879-9704-C99802FC7C39}; ClientMachine = HV-CINDER-83538; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1632; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1343296023; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	759	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	556	1648	hv-cinder-83538	S-1-5-18	6/21/2022 8:57:14 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {B6832DCA-CBAA-46EC-AFFB-28305205D557}; ClientMachine = HV-CINDER-83538; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1632; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1650089888; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	758	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	556	4236	hv-cinder-83538	S-1-5-18	6/21/2022 8:57:13 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {6E2B7C59-9BD7-4BBD-8479-06CEE1708906}; ClientMachine = HV-CINDER-83538; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1632; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{898A7E75-2310-4E51-991B-328C8460934D}"; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	757	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	556	3200	hv-cinder-83538	S-1-5-18	6/21/2022 8:57:11 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {406BEA97-8677-4323-9ACA-FB1B898EB340}; ClientMachine = HV-CINDER-83538; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1632; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1842006027; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	756	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	556	1648	hv-cinder-83538	S-1-5-18	6/21/2022 8:57:09 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {DB41CAB3-0E1D-44CE-8CDB-9602B7B9EEF4}; ClientMachine = HV-CINDER-83538; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1632; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1546593548; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	755	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	556	3200	hv-cinder-83538	S-1-5-18	6/21/2022 8:57:08 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {E3236DC8-F406-4552-9496-EAEDC71A45A6}; ClientMachine = HV-CINDER-83538; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1632; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{17A12F78-E9F7-4ED2-AA37-87AE40FACEFE}"; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	754	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	556	3200	hv-cinder-83538	S-1-5-18	6/21/2022 8:57:06 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {C80A790E-8497-4769-853E-4FA3F5C2928C}; ClientMachine = HV-CINDER-83538; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1632; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1522066569; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	753	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	556	1648	hv-cinder-83538	S-1-5-18	6/21/2022 8:57:06 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {61ADA604-BDF7-4715-B82E-11CE68AFF025}; ClientMachine = HV-CINDER-83538; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1632; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1620086961; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	752	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	556	3200	hv-cinder-83538	S-1-5-18	6/21/2022 8:57:06 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {A5F0D71B-C51F-4B00-BBF4-AE078B9A8026}; ClientMachine = HV-CINDER-83538; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1632; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1446001792; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	751	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	556	1648	hv-cinder-83538	S-1-5-18	6/21/2022 8:57:05 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {ACD9A7EA-914B-4054-8E2D-3E4256BE40E6}; ClientMachine = HV-CINDER-83538; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1632; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=804661013; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	750	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	556	1648	hv-cinder-83538	S-1-5-18	6/21/2022 8:57:05 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {F22F6B2D-CE98-49CB-9D36-544D3B281BB9}; ClientMachine = HV-CINDER-83538; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1632; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=742967048; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	749	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	556	536	hv-cinder-83538	S-1-5-18	6/21/2022 8:57:04 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
StorageWMI provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1668; ProviderPath = %SystemRoot%\System32\storagewmi.dll	5857	0	4611686018427387904	748	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	1668	3836	hv-cinder-83538	S-1-5-20	6/21/2022 8:56:58 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {89A5F7DD-60A7-4610-A2FF-ABAA6C67FD9F}; ClientMachine = HV-CINDER-83538; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1632; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=595212429; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	747	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	556	840	hv-cinder-83538	S-1-5-18	6/21/2022 8:56:57 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {6BCA086A-BFBA-4161-BEAA-EF543B08F384}; ClientMachine = HV-CINDER-83538; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1632; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=672739106; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	746	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	556	3240	hv-cinder-83538	S-1-5-18	6/21/2022 8:56:57 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {175C8FEA-B55A-4249-B82C-F982DB4E2179}; ClientMachine = HV-CINDER-83538; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1632; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Host.HostName="iqn.2010-10.org.openstack:volume-fb465a3d-8f17-41ed-b020-0c7069f73e99"; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	745	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	556	840	hv-cinder-83538	S-1-5-18	6/21/2022 8:56:56 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {4680355B-DFC7-4E63-B5A3-8D03839D6C82}; ClientMachine = HV-CINDER-83538; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1632; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Host.HostName="iqn.2010-10.org.openstack:volume-f63623c0-38bd-4e96-bb07-5f842853f29f"; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	744	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	556	3240	hv-cinder-83538	S-1-5-18	6/21/2022 8:56:55 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {5033F0EC-20BD-451D-B816-7E7C92A5BC0C}; ClientMachine = HV-CINDER-83538; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1632; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Host.HostName="iqn.2010-10.org.openstack:volume-6ed44576-d1fa-4f07-a209-d53f20b2cb79"; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	743	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	556	840	hv-cinder-83538	S-1-5-18	6/21/2022 8:56:54 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
MSVSS__PROVIDER provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1668; ProviderPath = %systemroot%\system32\wbem\vsswmi.dll	5857	0	4611686018427387904	742	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	1668	3836	hv-cinder-83538	S-1-5-20	6/21/2022 8:56:53 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FEC7DA78-8CCF-47A2-88EC-7FD4CD669FB3}; ClientMachine = HV-CINDER-83538; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1632; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_IDMethod.HostName="iqn.2010-10.org.openstack:volume-fb465a3d-8f17-41ed-b020-0c7069f73e99",Method=4,Value="iqn.1991-05.com.microsoft:hv-cinder-83538"; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	741	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	556	840	hv-cinder-83538	S-1-5-18	6/21/2022 8:56:53 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {4DEDB475-0406-4A5F-B12E-AD386CF3B647}; ClientMachine = HV-CINDER-83538; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1632; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_IDMethod.HostName="iqn.2010-10.org.openstack:volume-f63623c0-38bd-4e96-bb07-5f842853f29f",Method=4,Value="iqn.1991-05.com.microsoft:hv-cinder-83538"; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	740	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	556	3240	hv-cinder-83538	S-1-5-18	6/21/2022 8:56:53 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {E47FDBDA-644B-4F30-BF0F-532FB7A20FE8}; ClientMachine = HV-CINDER-83538; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1632; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_IDMethod.HostName="iqn.2010-10.org.openstack:volume-6ed44576-d1fa-4f07-a209-d53f20b2cb79",Method=4,Value="iqn.1991-05.com.microsoft:hv-cinder-83538"; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	739	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	556	3240	hv-cinder-83538	S-1-5-18	6/21/2022 8:56:52 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WMIProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3908; ProviderPath = %systemroot%\system32\wbem\wmiprov.dll	5857	0	4611686018427387904	738	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	3908	3300	hv-cinder-83538	S-1-5-18	6/21/2022 8:56:52 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {59A056E3-4F52-40A9-8B5F-00F2A764FF7B}; ClientMachine = HV-CINDER-83538; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1632; Component = Unknown; Operation = Start IWbemServices::ExecMethod - root\wmi : WT_Snapshot::Create; ResultCode = 0x800705B4; PossibleCause = Unknown	5858	2	4611686018427387904	737	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	556	840	hv-cinder-83538	S-1-5-18	6/21/2022 8:56:52 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
StorageWMI provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1668; ProviderPath = %SystemRoot%\System32\storagewmi.dll	5857	0	4611686018427387904	736	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	1668	3836	hv-cinder-83538	S-1-5-20	6/21/2022 8:49:36 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
StorageWMI provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1668; ProviderPath = %SystemRoot%\System32\storagewmi.dll	5857	0	4611686018427387904	735	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	1668	3836	hv-cinder-83538	S-1-5-20	6/21/2022 8:40:46 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
StorageWMI provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1668; ProviderPath = %SystemRoot%\System32\storagewmi.dll	5857	0	4611686018427387904	734	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	1668	3836	hv-cinder-83538	S-1-5-20	6/21/2022 8:39:34 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1668; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll	5857	0	4611686018427387904	733	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	1668	3836	hv-cinder-83538	S-1-5-20	6/21/2022 8:37:40 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1668; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll	5857	0	4611686018427387904	732	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	1668	3836	hv-cinder-83538	S-1-5-20	6/21/2022 8:36:39 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1668; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll	5857	0	4611686018427387904	731	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	1668	3836	hv-cinder-83538	S-1-5-20	6/21/2022 8:30:08 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
StorageWMI provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1668; ProviderPath = %SystemRoot%\System32\storagewmi.dll	5857	0	4611686018427387904	730	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	1668	3836	hv-cinder-83538	S-1-5-20	6/21/2022 8:29:33 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {59F2C009-5683-41B8-B05A-79526A6BCBB3}; ClientMachine = HV-CINDER-83538; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1632; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=58211335; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	729	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	556	4760	hv-cinder-83538	S-1-5-18	6/21/2022 8:25:34 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {52834E33-DBBC-4211-B61E-30BF0571E7B2}; ClientMachine = HV-CINDER-83538; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1632; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1866503692; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	728	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	556	2812	hv-cinder-83538	S-1-5-18	6/21/2022 8:25:32 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {5FA0C932-661B-4E04-987C-4DF5E789C650}; ClientMachine = HV-CINDER-83538; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1632; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=2115283242; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	727	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	556	536	hv-cinder-83538	S-1-5-18	6/21/2022 8:25:31 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {A463EE8A-DF39-4BB5-8618-2902DE38E37C}; ClientMachine = HV-CINDER-83538; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1632; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=548358147; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	726	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	556	3200	hv-cinder-83538	S-1-5-18	6/21/2022 8:25:30 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {ACD21DD8-9CCB-4FE3-9B68-2226C29E1C26}; ClientMachine = HV-CINDER-83538; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1632; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{675CF962-A3A5-4C94-B6A2-BBA7C3CD79CE}"; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	725	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	556	4236	hv-cinder-83538	S-1-5-18	6/21/2022 8:25:29 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {3E1AA286-0E20-473E-AD26-C9DDCF3BF37E}; ClientMachine = HV-CINDER-83538; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1632; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1441342815; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	724	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	556	4760	hv-cinder-83538	S-1-5-18	6/21/2022 8:25:29 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {C375FC98-981B-402F-85A8-32128DAB0473}; ClientMachine = HV-CINDER-83538; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1632; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{241B4A89-FCFC-4724-84E0-9F77D8058C3B}"; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	723	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	556	3200	hv-cinder-83538	S-1-5-18	6/21/2022 8:25:17 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {34F1E7C3-EC90-4F1C-BA27-12BFAB3B72B3}; ClientMachine = HV-CINDER-83538; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1632; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{A823B60C-1252-4924-876C-1F80DF44CF49}"; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	722	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	556	536	hv-cinder-83538	S-1-5-18	6/21/2022 8:25:16 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {973DE3E0-B3AB-431C-BFD4-FC214020F913}; ClientMachine = HV-CINDER-83538; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1632; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1923386442; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	721	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	556	4236	hv-cinder-83538	S-1-5-18	6/21/2022 8:25:09 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {977F8E3C-EF85-45FE-9133-E991C17027E4}; ClientMachine = HV-CINDER-83538; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1632; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Host.HostName="iqn.2010-10.org.openstack:volume-e5f48d53-8198-4f65-a5ed-893b86587118"; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	720	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	556	4236	hv-cinder-83538	S-1-5-18	6/21/2022 8:24:59 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {87DBF078-EB4C-4CCF-B416-1543FFC99692}; ClientMachine = HV-CINDER-83538; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1632; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_IDMethod.HostName="iqn.2010-10.org.openstack:volume-e5f48d53-8198-4f65-a5ed-893b86587118",Method=4,Value="iqn.1991-05.com.microsoft:hv-cinder-83538"; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	719	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	556	4236	hv-cinder-83538	S-1-5-18	6/21/2022 8:24:58 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9E6408F3-A440-4589-866C-270039EAEA05}; ClientMachine = HV-CINDER-83538; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1632; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{4C548CC8-802E-46E9-9C48-3EB1A6E5B68B}"; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	718	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	556	4236	hv-cinder-83538	S-1-5-18	6/21/2022 8:24:52 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {634523B2-5E30-4BB5-88BD-ACE31A556F27}; ClientMachine = HV-CINDER-83538; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1632; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1345150513; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	717	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	556	4760	hv-cinder-83538	S-1-5-18	6/21/2022 8:24:52 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {1AA7C1E3-7A08-4211-B97B-18B42ADAC6BA}; ClientMachine = HV-CINDER-83538; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1632; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{7E8A31C3-960F-471D-ABE1-272BF5DCB595}"; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	716	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	556	536	hv-cinder-83538	S-1-5-18	6/21/2022 8:24:51 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {3C6B4895-9076-4D49-AEB0-F0ED7DFC6E39}; ClientMachine = HV-CINDER-83538; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1632; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{3CD50BCA-DD8F-4882-8ACC-E90CE36B4AF2}"; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	715	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	556	2248	hv-cinder-83538	S-1-5-18	6/21/2022 8:24:51 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {968967C2-A233-4F3A-8E9B-4E7D3A068E19}; ClientMachine = HV-CINDER-83538; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1632; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{C4D3BC72-5D00-40C4-BD0A-E8D7F9B0B858}"; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	714	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	556	536	hv-cinder-83538	S-1-5-18	6/21/2022 8:24:50 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {2CD8C6F7-9FE6-4C8A-BB78-8EAC74055AA2}; ClientMachine = HV-CINDER-83538; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1632; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=321285332; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	713	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	556	796	hv-cinder-83538	S-1-5-18	6/21/2022 8:24:30 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {F40D45CE-A101-4DDA-B08B-DB21369589C3}; ClientMachine = HV-CINDER-83538; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1632; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{A5674CF2-2570-4AAF-B0EC-7977B2F753F3}"; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	712	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	556	3200	hv-cinder-83538	S-1-5-18	6/21/2022 8:24:22 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {808212A4-423F-4335-89B7-D44A5A24BA7A}; ClientMachine = HV-CINDER-83538; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1632; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{4E673A29-0179-4A4D-8F26-9773568D4B79}"; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	711	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	556	4236	hv-cinder-83538	S-1-5-18	6/21/2022 8:24:20 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9C7280CC-E356-4C3D-867D-7F716B787D42}; ClientMachine = HV-CINDER-83538; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1632; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{0DAB9A3D-F23C-45FC-9320-C96E31EDC7FA}"; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	710	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	556	4236	hv-cinder-83538	S-1-5-18	6/21/2022 8:24:13 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
StorageWMI provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1668; ProviderPath = %SystemRoot%\System32\storagewmi.dll	5857	0	4611686018427387904	709	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	1668	1092	hv-cinder-83538	S-1-5-20	6/21/2022 8:24:12 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {87A862E0-1E70-4BDB-9FFD-A8508230DD7C}; ClientMachine = HV-CINDER-83538; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1632; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=290769473; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	708	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	556	4236	hv-cinder-83538	S-1-5-18	6/21/2022 8:24:11 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {2E253AD1-9D94-434B-94FC-87E5CA732BB6}; ClientMachine = HV-CINDER-83538; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1632; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{AAD60935-B30E-44CA-B9BB-B64AEA62BB5F}"; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	707	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	556	536	hv-cinder-83538	S-1-5-18	6/21/2022 8:24:04 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {E57C17DF-EDDE-4BF2-99FA-4543EFAF5183}; ClientMachine = HV-CINDER-83538; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1632; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{E5AFF928-FA87-4B9F-B094-E3F1D489DB24}"; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	706	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	556	796	hv-cinder-83538	S-1-5-18	6/21/2022 8:23:57 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {14906037-821E-4CA2-943F-6751EB413A55}; ClientMachine = HV-CINDER-83538; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1632; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=457290665; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	705	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	556	796	hv-cinder-83538	S-1-5-18	6/21/2022 8:23:19 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {6806ACB6-3DDE-4043-9F7A-5E77018471A1}; ClientMachine = HV-CINDER-83538; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1632; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=437091089; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	704	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	556	2812	hv-cinder-83538	S-1-5-18	6/21/2022 8:23:18 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {A1DC4AB3-EE88-4E7E-AEA9-51E691CED64D}; ClientMachine = HV-CINDER-83538; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1632; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1050449122; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	703	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	556	2812	hv-cinder-83538	S-1-5-18	6/21/2022 8:23:17 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {75F47AC5-D1AE-43A1-87BB-B374DDD81002}; ClientMachine = HV-CINDER-83538; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1632; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1442457136; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	702	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	556	4236	hv-cinder-83538	S-1-5-18	6/21/2022 8:23:03 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {40EC772A-2E3A-4210-B23C-C0084CBF75EF}; ClientMachine = HV-CINDER-83538; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1632; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Host.HostName="iqn.2010-10.org.openstack:volume-4d22cd4a-4931-4853-96e6-e9f15c4dc2c3"; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	701	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	556	4236	hv-cinder-83538	S-1-5-18	6/21/2022 8:23:00 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {2C6074BF-C8C3-4B5B-A652-C6D7DFCB202F}; ClientMachine = HV-CINDER-83538; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1632; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_IDMethod.HostName="iqn.2010-10.org.openstack:volume-4d22cd4a-4931-4853-96e6-e9f15c4dc2c3",Method=4,Value="iqn.1991-05.com.microsoft:hv-cinder-83538"; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	700	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	556	796	hv-cinder-83538	S-1-5-18	6/21/2022 8:23:00 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {ABF532A0-7232-493F-8E3D-D29C2F5FD597}; ClientMachine = HV-CINDER-83538; User = NT AUTHORITY\SYSTEM; ClientProcessId = 684; Component = Unknown; Operation = Start IWbemServices::GetObject - root\virtualization\v2 : \\.\ROOT\virtualization\v2:Msvm_VirtualSystemSettingData.InstanceID="Microsoft:9757A0A9-33B6-476B-A5AC-438DA258A5F5"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	699	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	556	4236	hv-cinder-83538	S-1-5-18	6/21/2022 8:22:57 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {383830D1-D16B-42BA-B1B8-6D489B534F52}; ClientMachine = HV-CINDER-83538; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1632; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=653323547; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	698	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	556	1316	hv-cinder-83538	S-1-5-18	6/21/2022 8:22:53 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {6C0DBD0D-4A9C-4069-93F4-F82624D4607E}; ClientMachine = HV-CINDER-83538; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1632; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{EB78DFAB-1BF6-4388-9FBF-E462ECFA7AC4}"; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	697	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	556	4236	hv-cinder-83538	S-1-5-18	6/21/2022 8:22:51 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
StorageWMI provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1668; ProviderPath = %SystemRoot%\System32\storagewmi.dll	5857	0	4611686018427387904	696	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	1668	2296	hv-cinder-83538	S-1-5-20	6/21/2022 8:22:41 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {6ECF270F-87C6-45A2-BA80-30D2889BF34A}; ClientMachine = HV-CINDER-83538; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1632; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1417427379; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	695	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	556	2248	hv-cinder-83538	S-1-5-18	6/21/2022 8:22:40 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {8403A636-6A5A-4C84-AB58-ED53A9B61B5B}; ClientMachine = HV-CINDER-83538; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1632; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1833643924; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	694	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	556	2812	hv-cinder-83538	S-1-5-18	6/21/2022 8:22:39 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {E03E3C49-8C90-4C4F-9AEF-AA5F889CD1AD}; ClientMachine = HV-CINDER-83538; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1632; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1145708348; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	693	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	556	4236	hv-cinder-83538	S-1-5-18	6/21/2022 8:22:39 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {5AFB03E0-3FD9-4B3C-A57B-06EA343D4C59}; ClientMachine = HV-CINDER-83538; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1632; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=302424500; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	692	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	556	4236	hv-cinder-83538	S-1-5-18	6/21/2022 8:22:39 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {07419FCC-D337-410A-985E-865177E8AD4C}; ClientMachine = HV-CINDER-83538; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1632; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=688403202; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	691	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	556	3240	hv-cinder-83538	S-1-5-18	6/21/2022 8:22:38 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {E5FDA259-242D-4235-9971-D98738E9320A}; ClientMachine = HV-CINDER-83538; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1632; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{4F076E2C-667B-4949-961F-E2CAB10B1311}"; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	690	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	556	2248	hv-cinder-83538	S-1-5-18	6/21/2022 8:22:38 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {63D29642-891B-4546-8E92-2439347EEA2F}; ClientMachine = HV-CINDER-83538; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1632; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{769B67D1-2FA4-4824-90D7-901B77D0BBBC}"; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	689	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	556	2248	hv-cinder-83538	S-1-5-18	6/21/2022 8:22:37 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {D0D14EFC-809E-4EAF-A86B-E6A44A072FAF}; ClientMachine = HV-CINDER-83538; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1632; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1445712365; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	688	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	556	2812	hv-cinder-83538	S-1-5-18	6/21/2022 8:22:37 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {10B96D27-8A70-4DF2-89F3-9EFFD6E1BAE2}; ClientMachine = HV-CINDER-83538; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1632; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=553028975; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	687	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	556	2248	hv-cinder-83538	S-1-5-18	6/21/2022 8:22:37 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {F0C5E840-8AD5-4A1E-B311-AED5DDA7BECC}; ClientMachine = HV-CINDER-83538; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1632; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=637721318; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	686	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	556	1316	hv-cinder-83538	S-1-5-18	6/21/2022 8:22:21 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {067DFF73-591A-4B2B-8FE3-82E1D4F58292}; ClientMachine = HV-CINDER-83538; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1632; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=477889955; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	685	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	556	4236	hv-cinder-83538	S-1-5-18	6/21/2022 8:22:20 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {ECB0A395-A9C6-42E7-936F-20163F72CBF8}; ClientMachine = HV-CINDER-83538; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1632; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=218163348; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	684	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	556	2812	hv-cinder-83538	S-1-5-18	6/21/2022 8:22:19 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {3916FE17-73B7-4EEE-BAE0-797CD46E9A95}; ClientMachine = HV-CINDER-83538; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1632; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1717548856; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	683	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	556	2812	hv-cinder-83538	S-1-5-18	6/21/2022 8:22:18 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {D5DA6C2E-BDCE-4DBD-AC73-356C32FB2C1D}; ClientMachine = HV-CINDER-83538; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1632; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=297321551; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	682	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	556	1316	hv-cinder-83538	S-1-5-18	6/21/2022 8:22:15 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {3D716296-9637-4D9D-AAC9-D0D57B29B72A}; ClientMachine = HV-CINDER-83538; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1632; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1978941244; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	681	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	556	1316	hv-cinder-83538	S-1-5-18	6/21/2022 8:22:15 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {4A2491F0-572A-41F6-99E0-6314E8D345EA}; ClientMachine = HV-CINDER-83538; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1632; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{715901E6-37FB-4581-A4BD-3290E2462330}"; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	680	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	556	3864	hv-cinder-83538	S-1-5-18	6/21/2022 8:22:13 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {5304DCC1-D028-4250-A83A-D54A46A69E0E}; ClientMachine = HV-CINDER-83538; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1632; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1147734242; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	679	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	556	4760	hv-cinder-83538	S-1-5-18	6/21/2022 8:22:12 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {81BF023B-3D2F-4F9C-8492-F1578B7945F3}; ClientMachine = HV-CINDER-83538; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1632; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1219541440; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	678	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	556	2248	hv-cinder-83538	S-1-5-18	6/21/2022 8:22:10 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {52A01BAB-3488-4E15-9059-94A39774BBB7}; ClientMachine = HV-CINDER-83538; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1632; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=580070890; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	677	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	556	2248	hv-cinder-83538	S-1-5-18	6/21/2022 8:22:09 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {213F217B-249E-446A-AB2C-715C72CC396E}; ClientMachine = HV-CINDER-83538; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1632; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=818305318; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	676	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	556	2812	hv-cinder-83538	S-1-5-18	6/21/2022 8:21:50 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {F7B8F81C-D350-4CBF-82BB-2BB15806FD3A}; ClientMachine = HV-CINDER-83538; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1632; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1531907737; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	675	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	556	4760	hv-cinder-83538	S-1-5-18	6/21/2022 8:21:50 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {3A2EE15A-0D9F-4B08-B8D1-4B4D4CA3002E}; ClientMachine = HV-CINDER-83538; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1632; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1768794823; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	674	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	556	4760	hv-cinder-83538	S-1-5-18	6/21/2022 8:21:49 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FFEC446F-8E18-47BF-8F06-F532733FBCA0}; ClientMachine = HV-CINDER-83538; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1632; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1406778339; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	673	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	556	2248	hv-cinder-83538	S-1-5-18	6/21/2022 8:21:40 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {3164B579-CB8A-4C81-A0AD-64B34EC4C959}; ClientMachine = HV-CINDER-83538; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1632; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1017626498; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	672	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	556	4760	hv-cinder-83538	S-1-5-18	6/21/2022 8:21:38 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {A7ECCCC5-0DFB-4F55-BA5A-C6E906406850}; ClientMachine = HV-CINDER-83538; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1632; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=967664255; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	671	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	556	4760	hv-cinder-83538	S-1-5-18	6/21/2022 8:21:37 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {B334A51B-9848-4164-95C0-829352C464F9}; ClientMachine = HV-CINDER-83538; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1632; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=926073337; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	670	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	556	4760	hv-cinder-83538	S-1-5-18	6/21/2022 8:21:36 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {818DC451-19C2-4D21-A6C5-EFDC7C8CF2AD}; ClientMachine = HV-CINDER-83538; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1632; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{852A49D1-6271-4B0A-883F-C535E2F026E7}"; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	669	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	556	2248	hv-cinder-83538	S-1-5-18	6/21/2022 8:21:36 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {0FF3EE29-0046-4E1A-BF72-65E7FC3927F4}; ClientMachine = HV-CINDER-83538; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1632; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=925544460; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	668	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	556	2248	hv-cinder-83538	S-1-5-18	6/21/2022 8:21:35 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {738BCBA2-0F1F-42C4-903D-187340FEBA93}; ClientMachine = HV-CINDER-83538; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1632; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{AA693AE2-B840-471D-A9F3-6A3B9B988F84}"; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	667	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	556	3864	hv-cinder-83538	S-1-5-18	6/21/2022 8:21:35 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
MSVSS__PROVIDER provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1668; ProviderPath = %systemroot%\system32\wbem\vsswmi.dll	5857	0	4611686018427387904	666	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	1668	4280	hv-cinder-83538	S-1-5-20	6/21/2022 8:21:22 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32a provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1668; ProviderPath = %systemroot%\system32\wbem\wmipcima.dll	5857	0	4611686018427387904	665	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	1668	2296	hv-cinder-83538	S-1-5-20	6/21/2022 8:21:22 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WinTargetProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3268; ProviderPath = C:\windows\system32\wbem\WTWMIProv.dll	5857	0	4611686018427387904	664	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	3268	3856	hv-cinder-83538	S-1-5-19	6/21/2022 8:21:22 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1668; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll	5857	0	4611686018427387904	663	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	1668	2296	hv-cinder-83538	S-1-5-20	6/21/2022 8:21:08 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = HV-CINDER-83538; User = NT AUTHORITY\SYSTEM; ClientProcessId = 2516; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor; ResultCode = 0x80041032; PossibleCause = Unknown	5858	2	4611686018427387904	662	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	556	4760	hv-cinder-83538	S-1-5-18	6/21/2022 8:19:27 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Namespace = root\virtualization\v2; NotificationQuery = SELECT * FROM __InstanceDeletionEvent WITHIN 2 WHERE TargetInstance ISA 'Msvm_SyntheticEthernetPortSettingData' ; UserName = NT AUTHORITY\SYSTEM; ClientProcessID = 1684, ClientMachine = HV-CINDER-83538; PossibleCause = Temporary	5860	0	4611686018427387904	661	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	556	4360	hv-cinder-83538	S-1-5-18	6/21/2022 8:19:27 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Namespace = root\virtualization\v2; NotificationQuery = SELECT * FROM __InstanceCreationEvent WITHIN 2 WHERE TargetInstance ISA 'Msvm_SyntheticEthernetPortSettingData' ; UserName = NT AUTHORITY\SYSTEM; ClientProcessID = 1684, ClientMachine = HV-CINDER-83538; PossibleCause = Temporary	5860	0	4611686018427387904	660	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	556	4360	hv-cinder-83538	S-1-5-18	6/21/2022 8:19:27 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Namespace = root\virtualization\v2; NotificationQuery = SELECT EnabledState, TargetInstance FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA 'Msvm_ComputerSystem' AND TargetInstance.EnabledState != PreviousInstance.EnabledState AND (TargetInstance.EnabledState = '2' OR TargetInstance.EnabledState = '3' OR TargetInstance.EnabledState = '32768' OR TargetInstance.EnabledState = '32769'); UserName = NT AUTHORITY\SYSTEM; ClientProcessID = 684, ClientMachine = HV-CINDER-83538; PossibleCause = Temporary	5860	0	4611686018427387904	659	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	556	2556	hv-cinder-83538	S-1-5-18	6/21/2022 8:19:25 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WinTargetProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4964; ProviderPath = C:\windows\system32\wbem\WTWMIProv.dll	5857	0	4611686018427387904	658	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	4964	1976	hv-cinder-83538	S-1-5-19	6/21/2022 8:19:23 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WMIProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4424; ProviderPath = %systemroot%\system32\wbem\wmiprov.dll	5857	0	4611686018427387904	657	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	4424	3536	hv-cinder-83538	S-1-5-18	6/21/2022 8:19:22 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Win32_WIN32_TERMINALSERVICE_Prov provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1668; ProviderPath = %SystemRoot%\system32\tscfgwmi.dll	5857	0	4611686018427387904	656	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	1668	1092	hv-cinder-83538	S-1-5-20	6/21/2022 8:19:08 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2292; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll	5857	0	4611686018427387904	655	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2292	4428	hv-cinder-83538	S-1-5-18	6/21/2022 8:18:58 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1668; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll	5857	0	4611686018427387904	654	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	1668	1092	hv-cinder-83538	S-1-5-20	6/21/2022 8:18:58 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1668; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll	5857	0	4611686018427387904	653	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	1668	1092	hv-cinder-83538	S-1-5-20	6/21/2022 8:18:57 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WMIProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4628; ProviderPath = %systemroot%\system32\wbem\wmiprov.dll	5857	0	4611686018427387904	652	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	4628	4152	hv-cinder-83538	S-1-5-18	6/21/2022 8:03:33 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32a provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4040; ProviderPath = %systemroot%\system32\wbem\wmipcima.dll	5857	0	4611686018427387904	651	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	4040	3512	hv-cinder-83538	S-1-5-20	6/21/2022 8:02:33 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Win32_WIN32_TERMINALSERVICE_Prov provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4040; ProviderPath = %SystemRoot%\system32\tscfgwmi.dll	5857	0	4611686018427387904	650	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	4040	3540	hv-cinder-83538	S-1-5-20	6/21/2022 8:02:32 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4040; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll	5857	0	4611686018427387904	649	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	4040	3512	hv-cinder-83538	S-1-5-20	6/21/2022 8:02:32 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
MSIProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3536; ProviderPath = %systemroot%\system32\wbem\msiprov.dll	5857	0	4611686018427387904	648	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	3536	3568	hv-cinder-83538	S-1-5-18	6/21/2022 7:32:30 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4136; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll	5857	0	4611686018427387904	647	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	4136	4504	hv-cinder-83538	S-1-5-20	6/21/2022 7:30:31 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {ADEE1D94-85A4-0003-3621-EEADA485D801}; ClientMachine = HV-CINDER-83538; User = HV-CINDER-83538\Admin; ClientProcessId = 3648; Component = Core; Operation = Start IWbemServices::ExecNotificationQuery - root\virtualization\v2 : SELECT * FROM __InstanceDeletionEvent WITHIN 2 WHERE TargetInstance ISA 'Msvm_ConcreteJob'; ResultCode = 0x800706BE; PossibleCause = Could not send status to client	5858	2	4611686018427387904	646	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	556	3680	hv-cinder-83538	S-1-5-18	6/21/2022 7:29:06 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {ADEE1D94-85A4-0003-3621-EEADA485D801}; ClientMachine = HV-CINDER-83538; User = HV-CINDER-83538\Admin; ClientProcessId = 3648; Component = Unknown; Operation = Start IWbemServices::ExecNotificationQuery - root\virtualization\v2 : SELECT * FROM __InstanceDeletionEvent WITHIN 2 WHERE TargetInstance ISA 'Msvm_ConcreteJob'; ResultCode = 0x80041032; PossibleCause = Unknown	5858	2	4611686018427387904	645	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	556	3228	hv-cinder-83538	S-1-5-18	6/21/2022 7:29:06 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {ADEE1D94-85A4-0003-3621-EEADA485D801}; ClientMachine = HV-CINDER-83538; User = HV-CINDER-83538\Admin; ClientProcessId = 3648; Component = Unknown; Operation = Start IWbemServices::ExecNotificationQuery - root\virtualization\v2 : SELECT * FROM __InstanceModificationEvent WITHIN 2 WHERE TargetInstance ISA 'Msvm_ConcreteJob'; ResultCode = 0x80041032; PossibleCause = Unknown	5858	2	4611686018427387904	644	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	556	3228	hv-cinder-83538	S-1-5-18	6/21/2022 7:29:05 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Namespace = root\virtualization\v2; NotificationQuery = SELECT * FROM __InstanceDeletionEvent WITHIN 2 WHERE TargetInstance ISA 'Msvm_ConcreteJob'; UserName = HV-CINDER-83538\Admin; ClientProcessID = 3648, ClientMachine = HV-CINDER-83538; PossibleCause = Temporary	5860	0	4611686018427387904	643	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	556	3228	hv-cinder-83538	S-1-5-18	6/21/2022 7:29:05 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Namespace = root\virtualization\v2; NotificationQuery = SELECT * FROM __InstanceModificationEvent WITHIN 2 WHERE TargetInstance ISA 'Msvm_ConcreteJob'; UserName = HV-CINDER-83538\Admin; ClientProcessID = 3648, ClientMachine = HV-CINDER-83538; PossibleCause = Temporary	5860	0	4611686018427387904	642	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	556	3228	hv-cinder-83538	S-1-5-18	6/21/2022 7:29:05 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NetAdapterCim provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3188; ProviderPath = %systemroot%\system32\wbem\NetAdapterCim.dll	5857	0	4611686018427387904	641	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	3188	1136	hv-cinder-83538	S-1-5-19	6/21/2022 7:29:04 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
nettcpip provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2960; ProviderPath = %systemroot%\system32\wbem\NetTCPIP.dll	5857	0	4611686018427387904	640	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2960	2996	hv-cinder-83538	S-1-5-20	6/21/2022 7:28:58 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
MSiSCSITargetProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2980; ProviderPath = C:\windows\system32\wbem\SmIscsiTargetProv.dll	5857	0	4611686018427387904	639	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2980	1152	hv-cinder-83538	S-1-5-20	6/21/2022 7:28:56 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WinTargetProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3300; ProviderPath = C:\windows\system32\wbem\WTWMIProv.dll	5857	0	4611686018427387904	638	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	3300	3468	hv-cinder-83538	S-1-5-19	6/21/2022 7:28:56 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WMIProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3536; ProviderPath = %systemroot%\system32\wbem\wmiprov.dll	5857	0	4611686018427387904	637	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	3536	3568	hv-cinder-83538	S-1-5-18	6/21/2022 7:28:56 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
MSiSCSITargetProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2980; ProviderPath = C:\windows\system32\wbem\SmIscsiTargetProv.dll	5857	0	4611686018427387904	636	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2980	88	hv-cinder-83538	S-1-5-20	6/21/2022 7:28:56 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Win32_WIN32_TERMINALSERVICE_Prov provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2960; ProviderPath = %SystemRoot%\system32\tscfgwmi.dll	5857	0	4611686018427387904	635	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2960	2996	hv-cinder-83538	S-1-5-20	6/21/2022 7:28:44 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
wfascim provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2960; ProviderPath = %systemroot%\system32\wbem\wfascim.dll	5857	0	4611686018427387904	634	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2960	2196	hv-cinder-83538	S-1-5-20	6/21/2022 7:28:40 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2960; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll	5857	0	4611686018427387904	633	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2960	3000	hv-cinder-83538	S-1-5-20	6/21/2022 7:27:31 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = HV-CINDER-83538; User = NT AUTHORITY\SYSTEM; ClientProcessId = 732; Component = Unknown; Operation = Start IWbemServices::CreateInstanceEnum - root\wmi : MSiSCSI_PortalInfoClass; ResultCode = 0x8004100C; PossibleCause = Unknown	5858	2	4611686018427387904	632	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	556	3976	hv-cinder-83538	S-1-5-18	6/21/2022 7:26:58 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = HV-CINDER-83538; User = NT AUTHORITY\SYSTEM; ClientProcessId = 732; Component = Unknown; Operation = Start IWbemServices::CreateInstanceEnum - root\wmi : MS_SM_AdapterInformationQuery; ResultCode = 0x8004100C; PossibleCause = Unknown	5858	2	4611686018427387904	631	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	556	3976	hv-cinder-83538	S-1-5-18	6/21/2022 7:26:58 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
wmiprov provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3536; ProviderPath = %systemroot%\system32\wbem\wmiprov.dll	5857	0	4611686018427387904	630	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	3536	3568	hv-cinder-83538	S-1-5-18	6/21/2022 7:26:58 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = HV-CINDER-83538; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3184; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\Microsoft\Windows\DeviceGuard : SELECT AvailableSecurityProperties FROM Win32_DeviceGuard ; ResultCode = 0x80041032; PossibleCause = Unknown	5858	2	4611686018427387904	629	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	556	1956	hv-cinder-83538	S-1-5-18	6/21/2022 7:26:55 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = HV-CINDER-83538; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3184; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\Microsoft\Windows\DeviceGuard : SELECT RequiredSecurityProperties FROM Win32_DeviceGuard ; ResultCode = 0x80041032; PossibleCause = Unknown	5858	2	4611686018427387904	628	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	556	2060	hv-cinder-83538	S-1-5-18	6/21/2022 7:26:55 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = HV-CINDER-83538; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3184; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\Microsoft\Windows\DeviceGuard : SELECT SecurityServicesConfigured FROM Win32_DeviceGuard ; ResultCode = 0x80041032; PossibleCause = Unknown	5858	2	4611686018427387904	627	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	556	2164	hv-cinder-83538	S-1-5-18	6/21/2022 7:26:55 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Win32_TpmProvider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2960; ProviderPath = C:\Windows\system32\wbem\Win32_TPM.dll	5857	0	4611686018427387904	626	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2960	2196	hv-cinder-83538	S-1-5-20	6/21/2022 7:26:55 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = HV-CINDER-83538; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3184; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\Microsoft\Windows\DeviceGuard : SELECT VirtualizationBasedSecurityStatus FROM Win32_DeviceGuard ; ResultCode = 0x80041032; PossibleCause = Unknown	5858	2	4611686018427387904	625	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	556	2060	hv-cinder-83538	S-1-5-18	6/21/2022 7:26:55 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = HV-CINDER-83538; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3184; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\Microsoft\Windows\DeviceGuard : SELECT SecurityServicesRunning FROM Win32_DeviceGuard ; ResultCode = 0x80041032; PossibleCause = Unknown	5858	2	4611686018427387904	624	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	556	2060	hv-cinder-83538	S-1-5-18	6/21/2022 7:26:55 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = HV-CINDER-83538; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3184; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\Microsoft\Windows\DeviceGuard : SELECT SecurityServicesRunning FROM Win32_DeviceGuard ; ResultCode = 0x80041032; PossibleCause = Unknown	5858	2	4611686018427387904	623	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	556	2060	hv-cinder-83538	S-1-5-18	6/21/2022 7:26:55 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = HV-CINDER-83538; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3184; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\Microsoft\Windows\DeviceGuard : SELECT AvailableSecurityProperties FROM Win32_DeviceGuard ; ResultCode = 0x80041032; PossibleCause = Unknown	5858	2	4611686018427387904	622	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	556	2060	hv-cinder-83538	S-1-5-18	6/21/2022 7:26:55 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = HV-CINDER-83538; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3184; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\Microsoft\Windows\DeviceGuard : SELECT RequiredSecurityProperties FROM Win32_DeviceGuard ; ResultCode = 0x80041032; PossibleCause = Unknown	5858	2	4611686018427387904	621	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	556	2164	hv-cinder-83538	S-1-5-18	6/21/2022 7:26:55 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = HV-CINDER-83538; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3184; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\Microsoft\Windows\DeviceGuard : SELECT VirtualizationBasedSecurityStatus FROM Win32_DeviceGuard ; ResultCode = 0x80041032; PossibleCause = Unknown	5858	2	4611686018427387904	620	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	556	2060	hv-cinder-83538	S-1-5-18	6/21/2022 7:26:55 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = HV-CINDER-83538; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3184; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\Microsoft\Windows\DeviceGuard : SELECT SecurityServicesRunning FROM Win32_DeviceGuard ; ResultCode = 0x80041032; PossibleCause = Unknown	5858	2	4611686018427387904	619	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	556	2164	hv-cinder-83538	S-1-5-18	6/21/2022 7:26:55 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = HV-CINDER-83538; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3184; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\Microsoft\Windows\DeviceGuard : SELECT SecurityServicesRunning FROM Win32_DeviceGuard ; ResultCode = 0x80041032; PossibleCause = Unknown	5858	2	4611686018427387904	618	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	556	2060	hv-cinder-83538	S-1-5-18	6/21/2022 7:26:55 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Win32_DeviceGuard provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2960; ProviderPath = %SystemRoot%\System32\Win32_DeviceGuard.dll	5857	0	4611686018427387904	617	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2960	2196	hv-cinder-83538	S-1-5-20	6/21/2022 7:26:55 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
SppProvider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2960; ProviderPath = %SystemRoot%\System32\sppwmi.dll	5857	0	4611686018427387904	616	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2960	2196	hv-cinder-83538	S-1-5-20	6/21/2022 7:26:53 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = HV-CINDER-83538; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3184; Component = Unknown; Operation = Start IWbemServices::ExecQuery - ROOT\CIMV2 : select ChassisTypes from Win32_SystemEnclosure; ResultCode = 0x80041032; PossibleCause = Unknown	5858	2	4611686018427387904	615	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	556	2060	hv-cinder-83538	S-1-5-18	6/21/2022 7:26:47 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = HV-CINDER-83538; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3184; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\CIMV2 : SELECT SMBIOSAssetTag FROM Win32_SystemEnclosure ; ResultCode = 0x80041032; PossibleCause = Unknown	5858	2	4611686018427387904	614	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	556	1956	hv-cinder-83538	S-1-5-18	6/21/2022 7:26:47 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = HV-CINDER-83538; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3184; Component = Unknown; Operation = Start IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT ID FROM Win32_ServerFeature; ResultCode = 0x80041032; PossibleCause = Unknown	5858	2	4611686018427387904	613	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	556	2164	hv-cinder-83538	S-1-5-18	6/21/2022 7:26:46 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4004; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll	5857	0	4611686018427387904	612	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	4004	3268	hv-cinder-83538	S-1-5-18	6/21/2022 7:26:41 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
ServerFeatureProvider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2960; ProviderPath = %windir%\system32\wbem\servercompprov.dll	5857	0	4611686018427387904	611	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2960	3000	hv-cinder-83538	S-1-5-20	6/21/2022 7:26:41 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9D6F479D-12FF-48BA-A86B-E0604063916A}; ClientMachine = HV-CINDER-83538; User = ; ClientProcessId = 556; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{FC491EF1-C4AA-4CE1-B329-414B101DB823}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	610	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	556	2928	hv-cinder-83538	S-1-5-18	6/21/2022 7:26:16 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9D6F479D-12FF-48BA-A86B-E0604063916A}; ClientMachine = HV-CINDER-83538; User = ; ClientProcessId = 556; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{fbf687e6-f063-4d9f-9f4f-fd9a26acdd5f}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	609	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	556	2928	hv-cinder-83538	S-1-5-18	6/21/2022 7:26:16 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9D6F479D-12FF-48BA-A86B-E0604063916A}; ClientMachine = HV-CINDER-83538; User = ; ClientProcessId = 556; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{FB2CA36D-0B40-4307-821B-A13B252DE56C}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	608	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	556	2928	hv-cinder-83538	S-1-5-18	6/21/2022 7:26:16 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9D6F479D-12FF-48BA-A86B-E0604063916A}; ClientMachine = HV-CINDER-83538; User = ; ClientProcessId = 556; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{f3ccc681-b74c-4060-9f26-cd84525dca2a}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	607	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	556	2928	hv-cinder-83538	S-1-5-18	6/21/2022 7:26:16 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9D6F479D-12FF-48BA-A86B-E0604063916A}; ClientMachine = HV-CINDER-83538; User = ; ClientProcessId = 556; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{F312195E-3D9D-447A-A3F5-08DFFA24735E}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	606	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	556	2928	hv-cinder-83538	S-1-5-18	6/21/2022 7:26:16 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9D6F479D-12FF-48BA-A86B-E0604063916A}; ClientMachine = HV-CINDER-83538; User = ; ClientProcessId = 556; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{E62688F0-25FD-4c90-BFF5-F508B9D2E31F}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	605	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	556	2928	hv-cinder-83538	S-1-5-18	6/21/2022 7:26:16 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9D6F479D-12FF-48BA-A86B-E0604063916A}; ClientMachine = HV-CINDER-83538; User = ; ClientProcessId = 556; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{E5094040-C46C-4115-B030-04FB2E545B00}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	604	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	556	2928	hv-cinder-83538	S-1-5-18	6/21/2022 7:26:16 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9D6F479D-12FF-48BA-A86B-E0604063916A}; ClientMachine = HV-CINDER-83538; User = ; ClientProcessId = 556; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{E4F48E54-F38D-4884-BFB9-D4D2E5729C18}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	603	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	556	2928	hv-cinder-83538	S-1-5-18	6/21/2022 7:26:16 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9D6F479D-12FF-48BA-A86B-E0604063916A}; ClientMachine = HV-CINDER-83538; User = ; ClientProcessId = 556; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{e437bc1c-aa7d-11d2-a382-00c04f991e27}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	602	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	556	2928	hv-cinder-83538	S-1-5-18	6/21/2022 7:26:16 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9D6F479D-12FF-48BA-A86B-E0604063916A}; ClientMachine = HV-CINDER-83538; User = ; ClientProcessId = 556; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{CF7639F3-ABA2-41DB-97F2-81E2C5DBFC5D}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	601	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	556	2928	hv-cinder-83538	S-1-5-18	6/21/2022 7:26:16 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9D6F479D-12FF-48BA-A86B-E0604063916A}; ClientMachine = HV-CINDER-83538; User = ; ClientProcessId = 556; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{cdeafc3d-948d-49dd-ab12-e578ba4af7aa}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	600	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	556	2928	hv-cinder-83538	S-1-5-18	6/21/2022 7:26:16 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9D6F479D-12FF-48BA-A86B-E0604063916A}; ClientMachine = HV-CINDER-83538; User = ; ClientProcessId = 556; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{c6dc5466-785a-11d2-84d0-00c04fb169f7}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	599	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	556	2928	hv-cinder-83538	S-1-5-18	6/21/2022 7:26:16 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9D6F479D-12FF-48BA-A86B-E0604063916A}; ClientMachine = HV-CINDER-83538; User = ; ClientProcessId = 556; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{C631DF4C-088F-4156-B058-4375F0853CD8}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	598	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	556	2928	hv-cinder-83538	S-1-5-18	6/21/2022 7:26:16 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9D6F479D-12FF-48BA-A86B-E0604063916A}; ClientMachine = HV-CINDER-83538; User = ; ClientProcessId = 556; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{C418DD9D-0D14-4efb-8FBF-CFE535C8FAC7}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	597	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	556	2928	hv-cinder-83538	S-1-5-18	6/21/2022 7:26:16 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9D6F479D-12FF-48BA-A86B-E0604063916A}; ClientMachine = HV-CINDER-83538; User = ; ClientProcessId = 556; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{C34B2751-1CF4-44F5-9262-C3FC39666591}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	596	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	556	2928	hv-cinder-83538	S-1-5-18	6/21/2022 7:26:16 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9D6F479D-12FF-48BA-A86B-E0604063916A}; ClientMachine = HV-CINDER-83538; User = ; ClientProcessId = 556; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{BC75B1ED-5833-4858-9BB8-CBF0B166DF9D}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	595	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	556	2928	hv-cinder-83538	S-1-5-18	6/21/2022 7:26:16 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9D6F479D-12FF-48BA-A86B-E0604063916A}; ClientMachine = HV-CINDER-83538; User = ; ClientProcessId = 556; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{BA649533-0AAC-4E04-B9BC-4DBAE0325B12}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	594	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	556	2928	hv-cinder-83538	S-1-5-18	6/21/2022 7:26:16 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9D6F479D-12FF-48BA-A86B-E0604063916A}; ClientMachine = HV-CINDER-83538; User = ; ClientProcessId = 556; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{B587E2B1-4D59-4e7e-AED9-22B9DF11D053}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	593	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	556	2928	hv-cinder-83538	S-1-5-18	6/21/2022 7:26:16 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9D6F479D-12FF-48BA-A86B-E0604063916A}; ClientMachine = HV-CINDER-83538; User = ; ClientProcessId = 556; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{B087BE9D-ED37-454f-AF9C-04291E351182}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	592	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	556	2928	hv-cinder-83538	S-1-5-18	6/21/2022 7:26:16 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9D6F479D-12FF-48BA-A86B-E0604063916A}; ClientMachine = HV-CINDER-83538; User = ; ClientProcessId = 556; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{AADCED64-746C-4633-A97C-D61349046527}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	591	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	556	2928	hv-cinder-83538	S-1-5-18	6/21/2022 7:26:16 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9D6F479D-12FF-48BA-A86B-E0604063916A}; ClientMachine = HV-CINDER-83538; User = ; ClientProcessId = 556; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{A3F3E39B-5D83-4940-B954-28315B82F0A8}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	590	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	556	2928	hv-cinder-83538	S-1-5-18	6/21/2022 7:26:16 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9D6F479D-12FF-48BA-A86B-E0604063916A}; ClientMachine = HV-CINDER-83538; User = ; ClientProcessId = 556; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{91FBB303-0CD5-4055-BF42-E512A681B325}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	589	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	556	2928	hv-cinder-83538	S-1-5-18	6/21/2022 7:26:16 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9D6F479D-12FF-48BA-A86B-E0604063916A}; ClientMachine = HV-CINDER-83538; User = ; ClientProcessId = 556; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{8A28E2C5-8D06-49A4-A08C-632DAA493E17}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	588	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	556	2928	hv-cinder-83538	S-1-5-18	6/21/2022 7:26:16 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9D6F479D-12FF-48BA-A86B-E0604063916A}; ClientMachine = HV-CINDER-83538; User = ; ClientProcessId = 556; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{827D319E-6EAC-11D2-A4EA-00C04F79F83A}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	587	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	556	2928	hv-cinder-83538	S-1-5-18	6/21/2022 7:26:16 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9D6F479D-12FF-48BA-A86B-E0604063916A}; ClientMachine = HV-CINDER-83538; User = ; ClientProcessId = 556; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{7B849a69-220F-451E-B3FE-2CB811AF94AE}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	586	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	556	2928	hv-cinder-83538	S-1-5-18	6/21/2022 7:26:16 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9D6F479D-12FF-48BA-A86B-E0604063916A}; ClientMachine = HV-CINDER-83538; User = ; ClientProcessId = 556; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{7933F41E-56F8-41d6-A31C-4148A711EE93}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	585	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	556	2928	hv-cinder-83538	S-1-5-18	6/21/2022 7:26:16 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9D6F479D-12FF-48BA-A86B-E0604063916A}; ClientMachine = HV-CINDER-83538; User = ; ClientProcessId = 556; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{74EE6C03-5363-4554-B161-627540339CAB}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	584	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	556	2928	hv-cinder-83538	S-1-5-18	6/21/2022 7:26:16 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9D6F479D-12FF-48BA-A86B-E0604063916A}; ClientMachine = HV-CINDER-83538; User = ; ClientProcessId = 556; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{728EE579-943C-4519-9EF7-AB56765798ED}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	583	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	556	2928	hv-cinder-83538	S-1-5-18	6/21/2022 7:26:16 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9D6F479D-12FF-48BA-A86B-E0604063916A}; ClientMachine = HV-CINDER-83538; User = ; ClientProcessId = 556; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{7150F9BF-48AD-4da4-A49C-29EF4A8369BA}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	582	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	556	2928	hv-cinder-83538	S-1-5-18	6/21/2022 7:26:16 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9D6F479D-12FF-48BA-A86B-E0604063916A}; ClientMachine = HV-CINDER-83538; User = ; ClientProcessId = 556; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{6A4C88C6-C502-4f74-8F60-2CB23EDC24E2}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	581	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	556	2928	hv-cinder-83538	S-1-5-18	6/21/2022 7:26:16 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9D6F479D-12FF-48BA-A86B-E0604063916A}; ClientMachine = HV-CINDER-83538; User = ; ClientProcessId = 556; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{6232C319-91AC-4931-9385-E70C2B099F0E}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	580	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	556	2928	hv-cinder-83538	S-1-5-18	6/21/2022 7:26:16 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9D6F479D-12FF-48BA-A86B-E0604063916A}; ClientMachine = HV-CINDER-83538; User = ; ClientProcessId = 556; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{4CFB60C1-FAA6-47f1-89AA-0B18730C9FD3}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	579	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	556	2928	hv-cinder-83538	S-1-5-18	6/21/2022 7:26:16 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9D6F479D-12FF-48BA-A86B-E0604063916A}; ClientMachine = HV-CINDER-83538; User = ; ClientProcessId = 556; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{4bcd6cde-777b-48b6-9804-43568e23545d}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	578	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	556	2928	hv-cinder-83538	S-1-5-18	6/21/2022 7:26:16 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9D6F479D-12FF-48BA-A86B-E0604063916A}; ClientMachine = HV-CINDER-83538; User = ; ClientProcessId = 556; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{4B7C3B0F-E993-4E06-A241-3FBE06943684}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	577	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	556	2928	hv-cinder-83538	S-1-5-18	6/21/2022 7:26:16 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9D6F479D-12FF-48BA-A86B-E0604063916A}; ClientMachine = HV-CINDER-83538; User = ; ClientProcessId = 556; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{42B5FAAE-6536-11d2-AE5A-0000F87571E3}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	576	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	556	2928	hv-cinder-83538	S-1-5-18	6/21/2022 7:26:16 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9D6F479D-12FF-48BA-A86B-E0604063916A}; ClientMachine = HV-CINDER-83538; User = ; ClientProcessId = 556; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{426031c0-0b47-4852-b0ca-ac3d37bfcb39}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	575	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	556	2928	hv-cinder-83538	S-1-5-18	6/21/2022 7:26:16 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9D6F479D-12FF-48BA-A86B-E0604063916A}; ClientMachine = HV-CINDER-83538; User = ; ClientProcessId = 556; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{3A0DBA37-F8B2-4356-83DE-3E90BD5C261F}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	574	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	556	2928	hv-cinder-83538	S-1-5-18	6/21/2022 7:26:16 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9D6F479D-12FF-48BA-A86B-E0604063916A}; ClientMachine = HV-CINDER-83538; User = ; ClientProcessId = 556; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{3610eda5-77ef-11d2-8dc5-00c04fa31a66}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	573	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	556	2928	hv-cinder-83538	S-1-5-18	6/21/2022 7:26:16 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9D6F479D-12FF-48BA-A86B-E0604063916A}; ClientMachine = HV-CINDER-83538; User = ; ClientProcessId = 556; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{2BFCC077-22D2-48DE-BDE1-2F618D9B476D}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	572	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	556	2928	hv-cinder-83538	S-1-5-18	6/21/2022 7:26:16 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9D6F479D-12FF-48BA-A86B-E0604063916A}; ClientMachine = HV-CINDER-83538; User = ; ClientProcessId = 556; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{2A8FDC61-2347-4C87-92F6-B05EB91A201A}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	571	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	556	2928	hv-cinder-83538	S-1-5-18	6/21/2022 7:26:16 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9D6F479D-12FF-48BA-A86B-E0604063916A}; ClientMachine = HV-CINDER-83538; User = ; ClientProcessId = 556; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{1A6364EB-776B-4120-ADE1-B63A406A76B5}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	570	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	556	2928	hv-cinder-83538	S-1-5-18	6/21/2022 7:26:16 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9D6F479D-12FF-48BA-A86B-E0604063916A}; ClientMachine = HV-CINDER-83538; User = ; ClientProcessId = 556; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{17D89FEC-5C44-4972-B12D-241CAEF74509}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	569	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	556	2928	hv-cinder-83538	S-1-5-18	6/21/2022 7:26:16 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9D6F479D-12FF-48BA-A86B-E0604063916A}; ClientMachine = HV-CINDER-83538; User = ; ClientProcessId = 556; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{16be69fa-4209-4250-88cb-716cf41954e0}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	568	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	556	2928	hv-cinder-83538	S-1-5-18	6/21/2022 7:26:16 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9D6F479D-12FF-48BA-A86B-E0604063916A}; ClientMachine = HV-CINDER-83538; User = ; ClientProcessId = 556; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{169EBF44-942F-4C43-87CE-13C93996EBBE}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	567	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	556	2928	hv-cinder-83538	S-1-5-18	6/21/2022 7:26:16 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9D6F479D-12FF-48BA-A86B-E0604063916A}; ClientMachine = HV-CINDER-83538; User = ; ClientProcessId = 556; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{0E28E245-9368-4853-AD84-6DA3BA35BB75}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	566	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	556	2928	hv-cinder-83538	S-1-5-18	6/21/2022 7:26:16 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9D6F479D-12FF-48BA-A86B-E0604063916A}; ClientMachine = HV-CINDER-83538; User = ; ClientProcessId = 556; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{0ACDD40C-75AC-47ab-BAA0-BF6DE7E7FE63}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	565	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	556	2928	hv-cinder-83538	S-1-5-18	6/21/2022 7:26:16 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32a provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2960; ProviderPath = %systemroot%\system32\wbem\wmipcima.dll	5857	0	4611686018427387904	564	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2960	3000	hv-cinder-83538	S-1-5-20	6/21/2022 7:26:09 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Namespace = //./root/CIMV2; NotificationQuery = select * from MSFT_SCMEventLogEvent; OwnerName = S-1-5-32-544; HostProcessID = 556; Provider= SCM Event Provider, queryID = 0; PossibleCause = Permanent	5859	0	4611686018427387904	563	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	556	3904	hv-cinder-83538	S-1-5-18	6/21/2022 7:26:08 PM	adee1d94-85a4-0000-261e-eeada485d801	microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Namespace = root\virtualization\v2; NotificationQuery = SELECT * FROM __ClassOperationEvent; UserName = .\SYSTEM; ClientProcessID = 0, ClientMachine = ; PossibleCause = Temporary	5860	0	4611686018427387904	562	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	556	2928	hv-cinder-83538	S-1-5-18	6/21/2022 7:26:07 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Namespace = //./root/subscription; Eventfilter = SCM Event Log Filter (refer to its activate eventid:5859); Consumer = NTEventLogEventConsumer="SCM Event Log Consumer"; PossibleCause = Binding EventFilter: instance of __EventFilter { CreatorSID = {1, 2, 0, 0, 0, 0, 0, 5, 32, 0, 0, 0, 32, 2, 0, 0}; EventNamespace = "root\\cimv2"; Name = "SCM Event Log Filter"; Query = "select * from MSFT_SCMEventLogEvent"; QueryLanguage = "WQL"; }; Perm. Consumer: instance of NTEventLogEventConsumer { Category = 0; CreatorSID = {1, 2, 0, 0, 0, 0, 0, 5, 32, 0, 0, 0, 32, 2, 0, 0}; EventType = 1; Name = "SCM Event Log Consumer"; NameOfUserSIDProperty = "sid"; SourceName = "Service Control Manager"; };	5861	0	4611686018427387904	561	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	556	3900	hv-cinder-83538	S-1-5-18	6/21/2022 7:26:07 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WMIProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3536; ProviderPath = %systemroot%\system32\wbem\wmiprov.dll	5857	0	4611686018427387904	560	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	3536	3568	hv-cinder-83538	S-1-5-18	6/21/2022 7:26:06 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WMIProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3536; ProviderPath = %systemroot%\system32\wbem\wmiprov.dll	5857	0	4611686018427387904	559	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	3536	3568	hv-cinder-83538	S-1-5-18	6/21/2022 7:26:06 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2960; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll	5857	0	4611686018427387904	558	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2960	3000	hv-cinder-83538	S-1-5-20	6/21/2022 7:26:01 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = HV-CINDER-83538; User = NT AUTHORITY\SYSTEM; ClientProcessId = 2516; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\virtualization\v2 : Msvm_ResourcePoolComponent.Name="Microsoft\|RDV Integration Component Resource Pool\|V2.0"; ResultCode = 0x80041010; PossibleCause = Unknown	5858	2	4611686018427387904	557	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	556	2944	hv-cinder-83538	S-1-5-18	6/21/2022 7:26:01 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = HV-CINDER-83538; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1584; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User : __Namespace.name="S_1_5_21_1170100609_2670170500_187364720_500"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	556	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	556	2936	hv-cinder-83538	S-1-5-18	6/21/2022 7:26:01 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-7DRR03FHJ0T; User = NT AUTHORITY\SYSTEM; ClientProcessId = 2600; Component = Unknown; Operation = Start IWbemServices::CreateInstanceEnum - root\wmi : MSiSCSI_PortalInfoClass; ResultCode = 0x8004100A; PossibleCause = Unknown	5858	2	4611686018427387904	555	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	376	748	WIN-5T344G8GM1H	S-1-5-18	6/21/2022 7:25:10 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-7DRR03FHJ0T; User = NT AUTHORITY\SYSTEM; ClientProcessId = 2600; Component = Unknown; Operation = Start IWbemServices::CreateInstanceEnum - root\wmi : MS_SM_AdapterInformationQuery; ResultCode = 0x8004100A; PossibleCause = Unknown	5858	2	4611686018427387904	554	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	376	748	WIN-5T344G8GM1H	S-1-5-18	6/21/2022 7:25:10 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-7DRR03FHJ0T; User = NT AUTHORITY\SYSTEM; ClientProcessId = 2172; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\virtualization\v2 : Msvm_ResourcePoolComponent.Name="Microsoft\|RDV Integration Component Resource Pool\|V2.0"; ResultCode = 0x80041010; PossibleCause = Unknown	5858	2	4611686018427387904	553	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	376	2420	WIN-5T344G8GM1H	S-1-5-18	6/21/2022 7:23:56 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-7DRR03FHJ0T; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1676; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\cimv2 : select * from Win32_OperatingSystem; ResultCode = 0x8004100A; PossibleCause = Unknown	5858	2	4611686018427387904	552	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	376	2420	WIN-5T344G8GM1H	S-1-5-18	6/21/2022 7:23:56 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4848; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\wmi : select * from WDMClassesOfDriver where ClassName = "RNDISMPStatisticsOID"; ResultCode = 0x80041032; PossibleCause = Unknown	5858	2	4611686018427387904	551	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	976	3432	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:48:09 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4848; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\wmi : select * from WMIBinaryMofResource where Name = "C:\\windows\\System32\\drivers\\en-US\\netvsc.sys.mui[NdisMofResource]"; ResultCode = 0x80041032; PossibleCause = Unknown	5858	2	4611686018427387904	550	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	976	3432	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:48:09 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
MSVDS__PROVIDER provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4460; ProviderPath = %systemroot%\system32\wbem\vdswmi.dll	5857	0	4611686018427387904	549	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	4460	5048	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 9:46:31 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4460; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll	5857	0	4611686018427387904	548	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	4460	5048	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 9:46:31 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WMIProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4848; ProviderPath = %systemroot%\system32\wbem\wmiprov.dll	5857	0	4611686018427387904	547	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	4848	4776	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:45:30 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = WIN-5T344G8GM1H\Administrator; ClientProcessId = 4956; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\Microsoft\Windows\Defender : SELECT * FROM MSFT_MpComputerStatus; ResultCode = 0x80041032; PossibleCause = Unknown	5858	2	4611686018427387904	546	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	976	1176	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:42:52 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
ProtectionManagement provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3752; ProviderPath = "%ProgramData%\Microsoft\Windows Defender\Platform\4.12.17007.18011-0\ProtectionManagement.dll"	5857	0	4611686018427387904	545	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	3752	2228	WIN-5T344G8GM1H	S-1-5-19	1/19/2018 9:42:52 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
MsNetImPlatform provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2776; ProviderPath = %systemroot%\system32\wbem\ndisimplatcim.dll	5857	0	4611686018427387904	544	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2776	3064	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 9:42:52 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4120; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll	5857	0	4611686018427387904	543	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	4120	4148	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:42:50 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
nettcpip provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2776; ProviderPath = %systemroot%\system32\wbem\NetTCPIP.dll	5857	0	4611686018427387904	542	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2776	1292	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 9:42:48 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NetAdapterCim provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3752; ProviderPath = %systemroot%\system32\wbem\NetAdapterCim.dll	5857	0	4611686018427387904	541	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	3752	2228	WIN-5T344G8GM1H	S-1-5-19	1/19/2018 9:42:48 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2776; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll	5857	0	4611686018427387904	540	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2776	3064	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 9:42:48 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
MSVDS__PROVIDER provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2776; ProviderPath = %systemroot%\system32\wbem\vdswmi.dll	5857	0	4611686018427387904	539	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2776	3064	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 9:42:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32a provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2776; ProviderPath = %systemroot%\system32\wbem\wmipcima.dll	5857	0	4611686018427387904	538	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2776	3064	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 9:42:16 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4120; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll	5857	0	4611686018427387904	537	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	4120	4148	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:41:43 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
nettcpip provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2776; ProviderPath = %systemroot%\system32\wbem\NetTCPIP.dll	5857	0	4611686018427387904	536	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2776	1292	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 9:41:39 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NetAdapterCim provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3752; ProviderPath = %systemroot%\system32\wbem\NetAdapterCim.dll	5857	0	4611686018427387904	535	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	3752	2228	WIN-5T344G8GM1H	S-1-5-19	1/19/2018 9:41:39 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2776; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll	5857	0	4611686018427387904	534	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2776	2812	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 9:41:39 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Namespace = //./root/CIMV2; NotificationQuery = select * from MSFT_SCMEventLogEvent; OwnerName = S-1-5-32-544; HostProcessID = 976; Provider= SCM Event Provider, queryID = 0; PossibleCause = Permanent	5859	0	4611686018427387904	533	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	976	2172	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:41:32 AM	ad8d0f9c-9109-0001-0a10-8dad0991d301	microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Namespace = root\virtualization\v2; NotificationQuery = SELECT * FROM __ClassOperationEvent; UserName = .\SYSTEM; ClientProcessID = 0, ClientMachine = ; PossibleCause = Temporary	5860	0	4611686018427387904	532	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	976	2680	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:41:32 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Namespace = //./root/subscription; Eventfilter = SCM Event Log Filter (refer to its activate eventid:5859); Consumer = NTEventLogEventConsumer="SCM Event Log Consumer"; PossibleCause = Binding EventFilter: instance of __EventFilter { CreatorSID = {1, 2, 0, 0, 0, 0, 0, 5, 32, 0, 0, 0, 32, 2, 0, 0}; EventNamespace = "root\\cimv2"; Name = "SCM Event Log Filter"; Query = "select * from MSFT_SCMEventLogEvent"; QueryLanguage = "WQL"; }; Perm. Consumer: instance of NTEventLogEventConsumer { Category = 0; CreatorSID = {1, 2, 0, 0, 0, 0, 0, 5, 32, 0, 0, 0, 32, 2, 0, 0}; EventType = 1; Name = "SCM Event Log Consumer"; NameOfUserSIDProperty = "sid"; SourceName = "Service Control Manager"; };	5861	0	4611686018427387904	531	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	976	388	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:41:32 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{FC491EF1-C4AA-4CE1-B329-414B101DB823}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	530	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	976	2680	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:41:32 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{fbf687e6-f063-4d9f-9f4f-fd9a26acdd5f}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	529	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	976	2680	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:41:32 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{FB2CA36D-0B40-4307-821B-A13B252DE56C}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	528	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	976	2680	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:41:32 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{f3ccc681-b74c-4060-9f26-cd84525dca2a}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	527	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	976	2680	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:41:32 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{F312195E-3D9D-447A-A3F5-08DFFA24735E}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	526	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	976	2680	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:41:32 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{E62688F0-25FD-4c90-BFF5-F508B9D2E31F}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	525	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	976	2680	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:41:32 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{E5094040-C46C-4115-B030-04FB2E545B00}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	524	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	976	2680	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:41:32 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{E4F48E54-F38D-4884-BFB9-D4D2E5729C18}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	523	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	976	2680	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:41:32 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{e437bc1c-aa7d-11d2-a382-00c04f991e27}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	522	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	976	2680	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:41:32 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{CF7639F3-ABA2-41DB-97F2-81E2C5DBFC5D}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	521	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	976	2680	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:41:32 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{cdeafc3d-948d-49dd-ab12-e578ba4af7aa}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	520	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	976	2680	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:41:32 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{c6dc5466-785a-11d2-84d0-00c04fb169f7}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	519	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	976	2680	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:41:32 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{C631DF4C-088F-4156-B058-4375F0853CD8}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	518	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	976	2680	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:41:32 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{C418DD9D-0D14-4efb-8FBF-CFE535C8FAC7}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	517	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	976	2680	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:41:32 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{C34B2751-1CF4-44F5-9262-C3FC39666591}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	516	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	976	2680	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:41:32 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{BC75B1ED-5833-4858-9BB8-CBF0B166DF9D}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	515	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	976	2680	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:41:32 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{BA649533-0AAC-4E04-B9BC-4DBAE0325B12}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	514	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	976	2680	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:41:32 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{B587E2B1-4D59-4e7e-AED9-22B9DF11D053}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	513	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	976	2680	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:41:32 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{B087BE9D-ED37-454f-AF9C-04291E351182}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	512	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	976	2680	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:41:32 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{AADCED64-746C-4633-A97C-D61349046527}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	511	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	976	2680	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:41:32 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{A3F3E39B-5D83-4940-B954-28315B82F0A8}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	510	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	976	2680	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:41:32 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{91FBB303-0CD5-4055-BF42-E512A681B325}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	509	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	976	2680	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:41:32 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{8A28E2C5-8D06-49A4-A08C-632DAA493E17}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	508	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	976	2680	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:41:32 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{827D319E-6EAC-11D2-A4EA-00C04F79F83A}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	507	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	976	2680	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:41:32 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{7B849a69-220F-451E-B3FE-2CB811AF94AE}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	506	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	976	2680	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:41:32 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{7933F41E-56F8-41d6-A31C-4148A711EE93}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	505	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	976	2680	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:41:32 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{74EE6C03-5363-4554-B161-627540339CAB}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	504	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	976	2680	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:41:32 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{728EE579-943C-4519-9EF7-AB56765798ED}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	503	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	976	2680	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:41:32 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{7150F9BF-48AD-4da4-A49C-29EF4A8369BA}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	502	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	976	2680	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:41:32 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{6A4C88C6-C502-4f74-8F60-2CB23EDC24E2}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	501	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	976	2680	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:41:32 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{6232C319-91AC-4931-9385-E70C2B099F0E}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	500	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	976	2680	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:41:32 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{4CFB60C1-FAA6-47f1-89AA-0B18730C9FD3}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	499	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	976	2680	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:41:32 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{4bcd6cde-777b-48b6-9804-43568e23545d}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	498	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	976	2680	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:41:32 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{4B7C3B0F-E993-4E06-A241-3FBE06943684}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	497	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	976	2680	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:41:32 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{42B5FAAE-6536-11d2-AE5A-0000F87571E3}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	496	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	976	2680	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:41:32 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{426031c0-0b47-4852-b0ca-ac3d37bfcb39}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	495	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	976	2680	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:41:32 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{3A0DBA37-F8B2-4356-83DE-3E90BD5C261F}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	494	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	976	2680	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:41:32 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{3610eda5-77ef-11d2-8dc5-00c04fa31a66}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	493	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	976	2680	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:41:32 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{2BFCC077-22D2-48DE-BDE1-2F618D9B476D}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	492	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	976	2680	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:41:32 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{2A8FDC61-2347-4C87-92F6-B05EB91A201A}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	491	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	976	2680	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:41:32 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{1A6364EB-776B-4120-ADE1-B63A406A76B5}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	490	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	976	2680	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:41:32 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{17D89FEC-5C44-4972-B12D-241CAEF74509}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	489	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	976	2680	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:41:32 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{16be69fa-4209-4250-88cb-716cf41954e0}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	488	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	976	2680	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:41:32 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{169EBF44-942F-4C43-87CE-13C93996EBBE}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	487	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	976	2680	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:41:32 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{0E28E245-9368-4853-AD84-6DA3BA35BB75}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	486	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	976	2680	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:41:32 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{0ACDD40C-75AC-47ab-BAA0-BF6DE7E7FE63}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	485	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	976	2680	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:41:32 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2776; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll	5857	0	4611686018427387904	484	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2776	2848	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 9:41:31 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 2204; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\virtualization\v2 : Msvm_ResourcePoolComponent.Name="Microsoft\|RDV Integration Component Resource Pool\|V2.0"; ResultCode = 0x80041010; PossibleCause = Unknown	5858	2	4611686018427387904	483	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	976	2692	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:41:30 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3176; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll	5857	0	4611686018427387904	482	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	3176	1548	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 9:40:26 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3952; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\interop\ms_409 : MSFTSM_RegisteredSubprofile; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	481	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	4728	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:38:50 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3952; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\interop\ms_409 : MSFTSM_SubProfileRequiresProfile; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	480	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	4728	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:38:50 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3952; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\interop\ms_409 : MSFTSM_RegisteredProfile; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	479	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	4728	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:38:50 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3952; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\interop\ms_409 : MSFTSM_ReferencedProfile; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	478	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	4728	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:38:50 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3952; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\interop\ms_409 : MSFTSM_ElementSoftwareIdentity; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	477	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	4728	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:38:50 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3952; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\interop\ms_409 : MSFTSM_ElementConformsToProfileEx; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	476	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	4728	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:38:50 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3952; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\interop\ms_409 : MSFTSM_ElementConformsToProfile; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	475	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	4728	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:38:50 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3952; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\cimv2\storage\ms_409 : __Namespace.Name='iscsitarget'; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	474	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	4728	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:38:50 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WMIProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3968; ProviderPath = %systemroot%\system32\wbem\wmiprov.dll	5857	0	4611686018427387904	473	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	3968	4084	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:38:50 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
MSVDS__PROVIDER provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2712; ProviderPath = %systemroot%\system32\wbem\vdswmi.dll	5857	0	4611686018427387904	472	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2712	592	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 9:38:50 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2712; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll	5857	0	4611686018427387904	471	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2712	592	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 9:38:49 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
nettcpip provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4348; ProviderPath = %systemroot%\system32\wbem\NetTCPIP.dll	5857	0	4611686018427387904	470	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	4348	2924	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 9:35:55 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NetAdapterCim provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4444; ProviderPath = %systemroot%\system32\wbem\NetAdapterCim.dll	5857	0	4611686018427387904	469	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	4444	4516	WIN-5T344G8GM1H	S-1-5-19	1/19/2018 9:35:55 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4348; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll	5857	0	4611686018427387904	468	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	4348	4632	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 9:35:55 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
MSVDS__PROVIDER provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4348; ProviderPath = %systemroot%\system32\wbem\vdswmi.dll	5857	0	4611686018427387904	467	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	4348	4632	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 9:35:41 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4348; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll	5857	0	4611686018427387904	466	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	4348	4632	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 9:35:41 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
nettcpip provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4824; ProviderPath = %systemroot%\system32\wbem\NetTCPIP.dll	5857	0	4611686018427387904	465	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	4824	1600	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 9:34:04 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NetAdapterCim provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1548; ProviderPath = %systemroot%\system32\wbem\NetAdapterCim.dll	5857	0	4611686018427387904	464	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	1548	2160	WIN-5T344G8GM1H	S-1-5-19	1/19/2018 9:34:04 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4824; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll	5857	0	4611686018427387904	463	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	4824	1600	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 9:34:04 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4824; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll	5857	0	4611686018427387904	462	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	4824	4808	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 9:34:04 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 764; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll	5857	0	4611686018427387904	461	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	764	1020	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:33:46 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
MSVDS__PROVIDER provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4824; ProviderPath = %systemroot%\system32\wbem\vdswmi.dll	5857	0	4611686018427387904	460	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	4824	4808	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 9:32:20 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4824; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll	5857	0	4611686018427387904	459	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	4824	4808	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 9:32:20 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WMIProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3968; ProviderPath = %systemroot%\system32\wbem\wmiprov.dll	5857	0	4611686018427387904	458	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	3968	4084	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:31:16 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
MSVDS__PROVIDER provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1520; ProviderPath = %systemroot%\system32\wbem\vdswmi.dll	5857	0	4611686018427387904	457	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	1520	2704	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 9:29:44 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1520; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll	5857	0	4611686018427387904	456	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	1520	2704	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 9:29:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {4693033F-66F0-46C4-8E27-99621765768B}; ClientMachine = WIN-5T344G8GM1H; User = WIN-5T344G8GM1H\Administrator; ClientProcessId = 4124; Component = Core; Operation = Start IWbemServices::ExecMethod - root\microsoft\windows\servermanager : MSFT_ServerManagerTasks::GetServerFeature; ResultCode = 0x800706BE; PossibleCause = Could not send status to client	5858	2	4611686018427387904	455	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2716	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:32 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {4693033F-66F0-46C4-8E27-99621765768B}; ClientMachine = WIN-5T344G8GM1H; User = WIN-5T344G8GM1H\Administrator; ClientProcessId = 4124; Component = Unknown; Operation = Start IWbemServices::ExecMethod - root\microsoft\windows\servermanager : MSFT_ServerManagerTasks::GetServerFeature; ResultCode = 0x80041032; PossibleCause = Unknown	5858	2	4611686018427387904	454	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	432	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:32 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4608; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll	5857	0	4611686018427387904	453	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	4608	4636	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:30 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
nettcpip provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2872; ProviderPath = %systemroot%\system32\wbem\NetTCPIP.dll	5857	0	4611686018427387904	452	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2872	2896	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 9:27:26 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NetAdapterCim provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4344; ProviderPath = %systemroot%\system32\wbem\NetAdapterCim.dll	5857	0	4611686018427387904	451	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	4344	4368	WIN-5T344G8GM1H	S-1-5-19	1/19/2018 9:27:26 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2872; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll	5857	0	4611686018427387904	450	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2872	2900	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 9:27:25 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
MSVDS__PROVIDER provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2872; ProviderPath = %systemroot%\system32\wbem\vdswmi.dll	5857	0	4611686018427387904	449	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2872	2900	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 9:27:20 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32a provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2872; ProviderPath = %systemroot%\system32\wbem\wmipcima.dll	5857	0	4611686018427387904	448	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2872	2900	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 9:27:19 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Namespace = //./root/CIMV2; NotificationQuery = select * from MSFT_SCMEventLogEvent; OwnerName = S-1-5-32-544; HostProcessID = 956; Provider= SCM Event Provider, queryID = 0; PossibleCause = Permanent	5859	0	4611686018427387904	447	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2284	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:18 AM	aff0bd57-9107-0002-9bbd-f0af0791d301	microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Namespace = root\virtualization\v2; NotificationQuery = SELECT * FROM __ClassOperationEvent; UserName = .\SYSTEM; ClientProcessID = 0, ClientMachine = ; PossibleCause = Temporary	5860	0	4611686018427387904	446	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:18 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Namespace = //./root/subscription; Eventfilter = SCM Event Log Filter (refer to its activate eventid:5859); Consumer = NTEventLogEventConsumer="SCM Event Log Consumer"; PossibleCause = Binding EventFilter: instance of __EventFilter { CreatorSID = {1, 2, 0, 0, 0, 0, 0, 5, 32, 0, 0, 0, 32, 2, 0, 0}; EventNamespace = "root\\cimv2"; Name = "SCM Event Log Filter"; Query = "select * from MSFT_SCMEventLogEvent"; QueryLanguage = "WQL"; }; Perm. Consumer: instance of NTEventLogEventConsumer { Category = 0; CreatorSID = {1, 2, 0, 0, 0, 0, 0, 5, 32, 0, 0, 0, 32, 2, 0, 0}; EventType = 1; Name = "SCM Event Log Consumer"; NameOfUserSIDProperty = "sid"; SourceName = "Service Control Manager"; };	5861	0	4611686018427387904	445	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2284	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:18 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{FC491EF1-C4AA-4CE1-B329-414B101DB823}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	444	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{fbf687e6-f063-4d9f-9f4f-fd9a26acdd5f}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	443	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{FB2CA36D-0B40-4307-821B-A13B252DE56C}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	442	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{f3ccc681-b74c-4060-9f26-cd84525dca2a}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	441	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{F312195E-3D9D-447A-A3F5-08DFFA24735E}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	440	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{E62688F0-25FD-4c90-BFF5-F508B9D2E31F}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	439	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{E5094040-C46C-4115-B030-04FB2E545B00}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	438	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{E4F48E54-F38D-4884-BFB9-D4D2E5729C18}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	437	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{e437bc1c-aa7d-11d2-a382-00c04f991e27}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	436	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{CF7639F3-ABA2-41DB-97F2-81E2C5DBFC5D}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	435	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{cdeafc3d-948d-49dd-ab12-e578ba4af7aa}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	434	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{c6dc5466-785a-11d2-84d0-00c04fb169f7}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	433	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{C631DF4C-088F-4156-B058-4375F0853CD8}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	432	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{C418DD9D-0D14-4efb-8FBF-CFE535C8FAC7}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	431	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{C34B2751-1CF4-44F5-9262-C3FC39666591}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	430	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{BC75B1ED-5833-4858-9BB8-CBF0B166DF9D}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	429	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{BA649533-0AAC-4E04-B9BC-4DBAE0325B12}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	428	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{B587E2B1-4D59-4e7e-AED9-22B9DF11D053}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	427	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{B087BE9D-ED37-454f-AF9C-04291E351182}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	426	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{AADCED64-746C-4633-A97C-D61349046527}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	425	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{A3F3E39B-5D83-4940-B954-28315B82F0A8}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	424	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{91FBB303-0CD5-4055-BF42-E512A681B325}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	423	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{8A28E2C5-8D06-49A4-A08C-632DAA493E17}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	422	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{827D319E-6EAC-11D2-A4EA-00C04F79F83A}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	421	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{7B849a69-220F-451E-B3FE-2CB811AF94AE}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	420	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2864	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{7933F41E-56F8-41d6-A31C-4148A711EE93}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	419	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2864	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{74EE6C03-5363-4554-B161-627540339CAB}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	418	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2864	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{728EE579-943C-4519-9EF7-AB56765798ED}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	417	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2864	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{7150F9BF-48AD-4da4-A49C-29EF4A8369BA}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	416	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2864	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{6A4C88C6-C502-4f74-8F60-2CB23EDC24E2}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	415	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2864	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{6232C319-91AC-4931-9385-E70C2B099F0E}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	414	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2864	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{4CFB60C1-FAA6-47f1-89AA-0B18730C9FD3}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	413	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2868	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{4bcd6cde-777b-48b6-9804-43568e23545d}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	412	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{4B7C3B0F-E993-4E06-A241-3FBE06943684}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	411	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{42B5FAAE-6536-11d2-AE5A-0000F87571E3}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	410	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2864	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{426031c0-0b47-4852-b0ca-ac3d37bfcb39}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	409	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2864	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{3A0DBA37-F8B2-4356-83DE-3E90BD5C261F}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	408	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2864	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{3610eda5-77ef-11d2-8dc5-00c04fa31a66}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	407	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2864	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{2BFCC077-22D2-48DE-BDE1-2F618D9B476D}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	406	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2864	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{2A8FDC61-2347-4C87-92F6-B05EB91A201A}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	405	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2868	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{1A6364EB-776B-4120-ADE1-B63A406A76B5}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	404	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2864	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{17D89FEC-5C44-4972-B12D-241CAEF74509}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	403	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2864	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{16be69fa-4209-4250-88cb-716cf41954e0}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	402	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2864	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{169EBF44-942F-4C43-87CE-13C93996EBBE}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	401	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{0E28E245-9368-4853-AD84-6DA3BA35BB75}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	400	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{0ACDD40C-75AC-47ab-BAA0-BF6DE7E7FE63}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	399	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{FC491EF1-C4AA-4CE1-B329-414B101DB823}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	398	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{fbf687e6-f063-4d9f-9f4f-fd9a26acdd5f}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	397	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{FB2CA36D-0B40-4307-821B-A13B252DE56C}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	396	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{f3ccc681-b74c-4060-9f26-cd84525dca2a}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	395	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{F312195E-3D9D-447A-A3F5-08DFFA24735E}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	394	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{E62688F0-25FD-4c90-BFF5-F508B9D2E31F}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	393	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{E5094040-C46C-4115-B030-04FB2E545B00}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	392	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{E4F48E54-F38D-4884-BFB9-D4D2E5729C18}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	391	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{e437bc1c-aa7d-11d2-a382-00c04f991e27}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	390	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{CF7639F3-ABA2-41DB-97F2-81E2C5DBFC5D}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	389	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{cdeafc3d-948d-49dd-ab12-e578ba4af7aa}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	388	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{c6dc5466-785a-11d2-84d0-00c04fb169f7}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	387	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{C631DF4C-088F-4156-B058-4375F0853CD8}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	386	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{C418DD9D-0D14-4efb-8FBF-CFE535C8FAC7}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	385	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{C34B2751-1CF4-44F5-9262-C3FC39666591}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	384	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{BC75B1ED-5833-4858-9BB8-CBF0B166DF9D}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	383	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{BA649533-0AAC-4E04-B9BC-4DBAE0325B12}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	382	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{B587E2B1-4D59-4e7e-AED9-22B9DF11D053}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	381	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{B087BE9D-ED37-454f-AF9C-04291E351182}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	380	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{AADCED64-746C-4633-A97C-D61349046527}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	379	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{A3F3E39B-5D83-4940-B954-28315B82F0A8}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	378	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{91FBB303-0CD5-4055-BF42-E512A681B325}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	377	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{8A28E2C5-8D06-49A4-A08C-632DAA493E17}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	376	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{827D319E-6EAC-11D2-A4EA-00C04F79F83A}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	375	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{7B849a69-220F-451E-B3FE-2CB811AF94AE}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	374	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{7933F41E-56F8-41d6-A31C-4148A711EE93}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	373	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{74EE6C03-5363-4554-B161-627540339CAB}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	372	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{728EE579-943C-4519-9EF7-AB56765798ED}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	371	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{7150F9BF-48AD-4da4-A49C-29EF4A8369BA}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	370	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{6A4C88C6-C502-4f74-8F60-2CB23EDC24E2}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	369	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{6232C319-91AC-4931-9385-E70C2B099F0E}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	368	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{4CFB60C1-FAA6-47f1-89AA-0B18730C9FD3}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	367	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{4bcd6cde-777b-48b6-9804-43568e23545d}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	366	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{4B7C3B0F-E993-4E06-A241-3FBE06943684}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	365	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{42B5FAAE-6536-11d2-AE5A-0000F87571E3}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	364	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{426031c0-0b47-4852-b0ca-ac3d37bfcb39}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	363	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{3A0DBA37-F8B2-4356-83DE-3E90BD5C261F}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	362	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{3610eda5-77ef-11d2-8dc5-00c04fa31a66}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	361	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{2BFCC077-22D2-48DE-BDE1-2F618D9B476D}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	360	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{2A8FDC61-2347-4C87-92F6-B05EB91A201A}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	359	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{1A6364EB-776B-4120-ADE1-B63A406A76B5}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	358	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{17D89FEC-5C44-4972-B12D-241CAEF74509}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	357	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{16be69fa-4209-4250-88cb-716cf41954e0}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	356	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{169EBF44-942F-4C43-87CE-13C93996EBBE}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	355	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{0E28E245-9368-4853-AD84-6DA3BA35BB75}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	354	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{0ACDD40C-75AC-47ab-BAA0-BF6DE7E7FE63}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	353	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2872; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll	5857	0	4611686018427387904	352	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2872	2900	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 2336; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\virtualization\v2 : Msvm_ResourcePoolComponent.Name="Microsoft\|RDV Integration Component Resource Pool\|V2.0"; ResultCode = 0x80041010; PossibleCause = Unknown	5858	2	4611686018427387904	351	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2864	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Namespace = ROOT\virtualization\v2; NotificationQuery = SELECT * FROM __ClassOperationEvent; UserName = .\SYSTEM; ClientProcessID = 0, ClientMachine = ; PossibleCause = Temporary	5860	0	4611686018427387904	350	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	968	2820	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:26:58 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 2360; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\virtualization\v2 : Msvm_ResourcePoolComponent.Name="Microsoft\|RDV Integration Component Resource Pool\|V2.0"; ResultCode = 0x80041010; PossibleCause = Unknown	5858	2	4611686018427387904	349	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	968	2820	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:26:52 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\HyperVCluster\v2 : Msvm_VirtualHardDiskState; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	348	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	968	2820	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:26:51 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\HyperVCluster\v2 : Msvm_VirtualHardDiskSettingData; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	347	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	968	2820	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:26:51 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\HyperVCluster\v2 : Msvm_VirtualHardDiskInfo; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	346	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	968	2820	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:26:51 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\HyperVCluster\v2 : Msvm_ServicingSettings; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	345	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	968	2820	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:26:51 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\HyperVCluster\v2 : CIM_SettingsDefineState; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	344	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	968	2820	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:26:51 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\HyperVCluster\v2 : CIM_ServiceAffectsElement; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	343	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	968	2820	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:26:51 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\HyperVCluster\v2 : CIM_ManagedElement; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	342	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	968	2820	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:26:51 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\HyperVCluster\v2 : CIM_ElementSettingData; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	341	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	968	2820	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:26:51 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\HyperVCluster\v2 : CIM_ElementCapabilities; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	340	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	968	2820	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:26:51 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\HyperVCluster\v2 : CIM_Dependency; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	339	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	968	2820	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:26:51 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\HyperVCluster\v2 : CIM_Component; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	338	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	968	2820	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:26:51 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\HyperVCluster\v2 : CIM_AffectedJobElement; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	337	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	968	2820	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:26:51 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\HyperVCluster\v2\ms_409 : Msvm_SummaryInformationBase; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	336	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	968	2820	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:26:51 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\HyperVCluster\v2\ms_409 : CIM_SettingsDefineState; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	335	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	968	2820	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:26:51 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\HyperVCluster\v2\ms_409 : CIM_ServiceAffectsElement; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	334	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	968	2824	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:26:51 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\HyperVCluster\v2\ms_409 : CIM_ManagedElement; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	333	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	968	2820	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:26:51 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\HyperVCluster\v2\ms_409 : CIM_ElementSettingData; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	332	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	968	2820	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:26:51 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\HyperVCluster\v2\ms_409 : CIM_ElementCapabilities; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	331	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	968	2820	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:26:51 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\HyperVCluster\v2\ms_409 : CIM_Dependency; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	330	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	968	2820	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:26:51 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\HyperVCluster\v2\ms_409 : CIM_Component; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	329	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	968	2820	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:26:51 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\HyperVCluster\v2\ms_409 : CIM_AffectedJobElement; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	328	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	968	2820	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:26:51 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Namespace = //./root/CIMV2; NotificationQuery = select * from MSFT_SCMEventLogEvent; OwnerName = S-1-5-32-544; HostProcessID = 968; Provider= SCM Event Provider, queryID = 0; PossibleCause = Permanent	5859	0	4611686018427387904	327	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	968	2948	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:26:51 AM	96ed06e7-9107-0000-3d07-ed960791d301	microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Namespace = //./root/subscription; Eventfilter = SCM Event Log Filter (refer to its activate eventid:5859); Consumer = NTEventLogEventConsumer="SCM Event Log Consumer"; PossibleCause = Binding EventFilter: instance of __EventFilter { CreatorSID = {1, 2, 0, 0, 0, 0, 0, 5, 32, 0, 0, 0, 32, 2, 0, 0}; EventNamespace = "root\\cimv2"; Name = "SCM Event Log Filter"; Query = "select * from MSFT_SCMEventLogEvent"; QueryLanguage = "WQL"; }; Perm. Consumer: instance of NTEventLogEventConsumer { Category = 0; CreatorSID = {1, 2, 0, 0, 0, 0, 0, 5, 32, 0, 0, 0, 32, 2, 0, 0}; EventType = 1; Name = "SCM Event Log Consumer"; NameOfUserSIDProperty = "sid"; SourceName = "Service Control Manager"; };	5861	0	4611686018427387904	326	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	968	2948	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:26:51 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2 : Msvm_VirtualDiskChangedRange; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	325	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	968	2820	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:26:50 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2 : Msvm_VHDSSnapshotInformation; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	324	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	968	2820	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:26:50 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2 : Msvm_VHDSetInformation; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	323	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	968	2820	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:26:50 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2 : Msvm_VirtualHardDiskSettingData; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	322	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	968	2820	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:26:50 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2 : Msvm_VirtualHardDiskInfo; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	321	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	968	2820	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:26:50 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2 : Msvm_SummaryInformationBase; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	320	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	968	2820	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:26:50 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2 : Msvm_ServicingSettings; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	319	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	968	2820	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:26:50 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2 : CIM_SettingsDefineState; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	318	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	968	2820	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:26:50 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2 : CIM_ServiceAffectsElement; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	317	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	968	2820	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:26:50 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2 : CIM_ManagedElement; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	316	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	968	2820	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:26:50 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2 : CIM_ElementSettingData; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	315	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	968	2820	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:26:50 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2 : CIM_ElementCapabilities; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	314	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	968	2820	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:26:50 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2 : CIM_Dependency; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	313	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	968	2820	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:26:50 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2 : CIM_Component; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	312	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	968	2820	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:26:50 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2 : CIM_AffectedJobElement; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	311	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	968	2820	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:26:50 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2\ms_409 : Msvm_VirtualDiskChangedRange; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	310	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	968	2820	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:26:49 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2\ms_409 : Msvm_VHDSSnapshotInformation; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	309	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	968	2820	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:26:49 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2\ms_409 : Msvm_VHDSetInformation; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	308	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	968	2820	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:26:49 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2\ms_409 : Msvm_VirtualHardDiskSettingData; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	307	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	968	2820	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:26:49 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2\ms_409 : Msvm_VirtualHardDiskInfo; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	306	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	968	2820	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:26:49 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2\ms_409 : Msvm_SummaryInformationBase; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	305	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	968	2820	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:26:49 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2\ms_409 : Msvm_ServicingSettings; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	304	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	968	2820	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:26:49 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2\ms_409 : CIM_SettingsDefineState; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	303	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	968	2820	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:26:49 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2\ms_409 : CIM_ServiceAffectsElement; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	302	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	968	2820	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:26:49 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2\ms_409 : CIM_ManagedElement; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	301	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	968	2820	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:26:49 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2\ms_409 : CIM_ElementSettingData; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	300	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	968	2820	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:26:49 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2\ms_409 : CIM_ElementCapabilities; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	299	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	968	2820	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:26:49 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2\ms_409 : CIM_Dependency; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	298	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	968	2820	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:26:49 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2\ms_409 : CIM_Component; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	297	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	968	2820	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:26:49 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2\ms_409 : CIM_AffectedJobElement; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	296	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	968	2820	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:26:49 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
MSVDS__PROVIDER provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2840; ProviderPath = %systemroot%\system32\wbem\vdswmi.dll	5857	0	4611686018427387904	295	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2840	2880	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 9:26:46 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32a provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2840; ProviderPath = %systemroot%\system32\wbem\wmipcima.dll	5857	0	4611686018427387904	294	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2840	2880	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 9:26:44 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2840; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll	5857	0	4611686018427387904	293	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2840	2864	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 9:26:42 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 308; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_ComputerSystem; ResultCode = 0x80041032; PossibleCause = Unknown	5858	2	4611686018427387904	292	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2620	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:25:03 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 308; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_ComputerSystem; ResultCode = 0x80041032; PossibleCause = Unknown	5858	2	4611686018427387904	291	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	404	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:25:02 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2528; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll	5857	0	4611686018427387904	290	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2528	3456	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:24:56 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
nettcpip provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2508; ProviderPath = %systemroot%\system32\wbem\NetTCPIP.dll	5857	0	4611686018427387904	289	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2508	4092	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 9:24:53 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NetAdapterCim provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2736; ProviderPath = %systemroot%\system32\wbem\NetAdapterCim.dll	5857	0	4611686018427387904	288	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2736	3804	WIN-5T344G8GM1H	S-1-5-19	1/19/2018 9:24:53 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2508; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll	5857	0	4611686018427387904	287	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2508	4092	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 9:24:53 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2508; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll	5857	0	4611686018427387904	286	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2508	2824	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 9:24:53 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3200; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll	5857	0	4611686018427387904	285	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	3200	3644	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:23:15 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
nettcpip provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2856; ProviderPath = %systemroot%\system32\wbem\NetTCPIP.dll	5857	0	4611686018427387904	284	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2856	2920	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 9:23:12 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NetAdapterCim provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2540; ProviderPath = %systemroot%\system32\wbem\NetAdapterCim.dll	5857	0	4611686018427387904	283	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2540	3240	WIN-5T344G8GM1H	S-1-5-19	1/19/2018 9:23:12 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2856; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll	5857	0	4611686018427387904	282	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2856	2884	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 9:23:11 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
MSVDS__PROVIDER provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2856; ProviderPath = %systemroot%\system32\wbem\vdswmi.dll	5857	0	4611686018427387904	281	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2856	2884	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 9:23:05 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32a provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2856; ProviderPath = %systemroot%\system32\wbem\wmipcima.dll	5857	0	4611686018427387904	280	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2856	2884	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 9:23:04 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Namespace = //./root/CIMV2; NotificationQuery = select * from MSFT_SCMEventLogEvent; OwnerName = S-1-5-32-544; HostProcessID = 956; Provider= SCM Event Provider, queryID = 0; PossibleCause = Permanent	5859	0	4611686018427387904	279	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2916	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:23:03 AM	17f2f0cc-9107-0002-12f1-f2170791d301	microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Namespace = //./root/subscription; Eventfilter = SCM Event Log Filter (refer to its activate eventid:5859); Consumer = NTEventLogEventConsumer="SCM Event Log Consumer"; PossibleCause = Binding EventFilter: instance of __EventFilter { CreatorSID = {1, 2, 0, 0, 0, 0, 0, 5, 32, 0, 0, 0, 32, 2, 0, 0}; EventNamespace = "root\\cimv2"; Name = "SCM Event Log Filter"; Query = "select * from MSFT_SCMEventLogEvent"; QueryLanguage = "WQL"; }; Perm. Consumer: instance of NTEventLogEventConsumer { Category = 0; CreatorSID = {1, 2, 0, 0, 0, 0, 0, 5, 32, 0, 0, 0, 32, 2, 0, 0}; EventType = 1; Name = "SCM Event Log Consumer"; NameOfUserSIDProperty = "sid"; SourceName = "Service Control Manager"; };	5861	0	4611686018427387904	278	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2908	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:23:03 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2856; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll	5857	0	4611686018427387904	277	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2856	2884	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 9:23:02 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3808; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll	5857	0	4611686018427387904	276	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	3808	4032	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:14:59 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
nettcpip provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2664; ProviderPath = %systemroot%\system32\wbem\NetTCPIP.dll	5857	0	4611686018427387904	275	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2664	2720	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 9:14:58 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NetAdapterCim provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2972; ProviderPath = %systemroot%\system32\wbem\NetAdapterCim.dll	5857	0	4611686018427387904	274	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2972	156	WIN-5T344G8GM1H	S-1-5-19	1/19/2018 9:14:58 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2664; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll	5857	0	4611686018427387904	273	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2664	2720	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 9:14:57 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2664; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll	5857	0	4611686018427387904	272	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2664	1584	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 9:14:57 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = WIN-5T344G8GM1H\Administrator; ClientProcessId = 1860; Component = Unknown; Operation = Start IWbemServices::PutInstance - root\cimv2 : Win32_ComputerSystem.Name="WIN-5T344G8GM1H"; ResultCode = 0x80041001; PossibleCause = Unknown	5858	2	4611686018427387904	271	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	1180	4136	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:11:39 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4368; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll	5857	0	4611686018427387904	270	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	4368	4496	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 9:10:55 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1784; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll	5857	0	4611686018427387904	269	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	1784	2240	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:05:00 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
nettcpip provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 952; ProviderPath = %systemroot%\system32\wbem\NetTCPIP.dll	5857	0	4611686018427387904	268	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	952	452	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 9:04:58 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NetAdapterCim provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1152; ProviderPath = %systemroot%\system32\wbem\NetAdapterCim.dll	5857	0	4611686018427387904	267	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	1152	1396	WIN-5T344G8GM1H	S-1-5-19	1/19/2018 9:04:58 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 952; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll	5857	0	4611686018427387904	266	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	952	452	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 9:04:57 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 952; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll	5857	0	4611686018427387904	265	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	952	1000	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 9:04:57 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WMIProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3176; ProviderPath = %systemroot%\system32\wbem\wmiprov.dll	5857	0	4611686018427387904	264	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	3176	3364	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:58:49 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
MSVDS__PROVIDER provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4672; ProviderPath = %systemroot%\system32\wbem\vdswmi.dll	5857	0	4611686018427387904	263	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	4672	4700	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 8:57:50 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4672; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll	5857	0	4611686018427387904	262	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	4672	4700	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 8:57:50 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 88; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_ComputerSystemProduct; ResultCode = 0x80041032; PossibleCause = Unknown	5858	2	4611686018427387904	261	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	1180	1284	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:56:50 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4672; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll	5857	0	4611686018427387904	260	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	4672	4700	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 8:56:50 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Namespace = //./root/CIMV2; NotificationQuery = select * from MSFT_SCMEventLogEvent; OwnerName = S-1-5-32-544; HostProcessID = 1180; Provider= SCM Event Provider, queryID = 0; PossibleCause = Permanent	5859	0	4611686018427387904	259	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	1180	4340	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:56:46 AM	289cfce6-9103-0003-f9fd-9c280391d301	microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Namespace = //./root/subscription; Eventfilter = SCM Event Log Filter (refer to its activate eventid:5859); Consumer = NTEventLogEventConsumer="SCM Event Log Consumer"; PossibleCause = Binding EventFilter: instance of __EventFilter { CreatorSID = {1, 2, 0, 0, 0, 0, 0, 5, 32, 0, 0, 0, 32, 2, 0, 0}; EventNamespace = "root\\cimv2"; Name = "SCM Event Log Filter"; Query = "select * from MSFT_SCMEventLogEvent"; QueryLanguage = "WQL"; }; Perm. Consumer: instance of NTEventLogEventConsumer { Category = 0; CreatorSID = {1, 2, 0, 0, 0, 0, 0, 5, 32, 0, 0, 0, 32, 2, 0, 0}; EventType = 1; Name = "SCM Event Log Consumer"; NameOfUserSIDProperty = "sid"; SourceName = "Service Control Manager"; };	5861	0	4611686018427387904	258	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	1180	4340	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:56:46 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
MSVDS__PROVIDER provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3968; ProviderPath = %systemroot%\system32\wbem\vdswmi.dll	5857	0	4611686018427387904	257	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	3968	4008	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 8:55:06 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32a provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3968; ProviderPath = %systemroot%\system32\wbem\wmipcima.dll	5857	0	4611686018427387904	256	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	3968	4008	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 8:55:05 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3688; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll	5857	0	4611686018427387904	255	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	3688	3696	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:55:04 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
nettcpip provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3968; ProviderPath = %systemroot%\system32\wbem\NetTCPIP.dll	5857	0	4611686018427387904	254	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	3968	4020	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 8:54:58 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NetAdapterCim provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4024; ProviderPath = %systemroot%\system32\wbem\NetAdapterCim.dll	5857	0	4611686018427387904	253	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	4024	4052	WIN-5T344G8GM1H	S-1-5-19	1/19/2018 8:54:58 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3968; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll	5857	0	4611686018427387904	252	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	3968	4008	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 8:54:58 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3968; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll	5857	0	4611686018427387904	251	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	3968	3996	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 8:54:58 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3880; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll	5857	0	4611686018427387904	250	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	3880	3916	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 8:54:38 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {7C5C4FFB-9102-0000-4A51-5C7C0291D301}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 1192; Component = Unknown; Operation = Start IWbemServices::ExecNotificationQuery - ROOT\CIMV2 : SELECT * FROM Win32_ProcessStartTrace WHERE ProcessName = 'wsmprovhost.exe'; ResultCode = 0x80041032; PossibleCause = Unknown	5858	2	4611686018427387904	249	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	1192	3004	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:54:34 AM	7c5c4ffb-9102-0000-4a51-5c7c0291d301	microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WMIProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1200; ProviderPath = %systemroot%\system32\wbem\wmiprov.dll	5857	0	4611686018427387904	248	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	1200	2840	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:54:03 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Namespace = ROOT\CIMV2; NotificationQuery = SELECT * FROM Win32_ProcessStartTrace WHERE ProcessName = 'wsmprovhost.exe'; UserName = ; ClientProcessID = 1192, ClientMachine = WIN-5T344G8GM1H; PossibleCause = Temporary	5860	0	4611686018427387904	247	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	1192	2792	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:52:27 AM	7c5c4ffb-9102-0001-8851-5c7c0291d301	microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WMI Kernel Trace Event Provider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1192; ProviderPath = C:\Windows\System32\wbem\krnlprov.dll	5857	0	4611686018427387904	246	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	1192	2792	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:52:27 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Namespace = //./root/CIMV2; NotificationQuery = select * from MSFT_SCMEventLogEvent; OwnerName = S-1-5-32-544; HostProcessID = 1192; Provider= SCM Event Provider, queryID = 0; PossibleCause = Permanent	5859	0	4611686018427387904	245	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	1192	2796	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:51:57 AM	7c5c4ffb-9102-0001-5f51-5c7c0291d301	microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Namespace = //./root/subscription; Eventfilter = SCM Event Log Filter (refer to its activate eventid:5859); Consumer = NTEventLogEventConsumer="SCM Event Log Consumer"; PossibleCause = Binding EventFilter: instance of __EventFilter { CreatorSID = {1, 2, 0, 0, 0, 0, 0, 5, 32, 0, 0, 0, 32, 2, 0, 0}; EventNamespace = "root\\cimv2"; Name = "SCM Event Log Filter"; Query = "select * from MSFT_SCMEventLogEvent"; QueryLanguage = "WQL"; }; Perm. Consumer: instance of NTEventLogEventConsumer { Category = 0; CreatorSID = {1, 2, 0, 0, 0, 0, 0, 5, 32, 0, 0, 0, 32, 2, 0, 0}; EventType = 1; Name = "SCM Event Log Consumer"; NameOfUserSIDProperty = "sid"; SourceName = "Service Control Manager"; };	5861	0	4611686018427387904	244	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	1192	2796	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:51:57 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
MSVDS__PROVIDER provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3832; ProviderPath = %systemroot%\system32\wbem\vdswmi.dll	5857	0	4611686018427387904	243	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	3832	3932	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 8:51:38 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32a provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3832; ProviderPath = %systemroot%\system32\wbem\wmipcima.dll	5857	0	4611686018427387904	242	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	3832	3872	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 8:51:37 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 428; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll	5857	0	4611686018427387904	241	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	428	1316	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:51:13 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
nettcpip provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3832; ProviderPath = %systemroot%\system32\wbem\NetTCPIP.dll	5857	0	4611686018427387904	240	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	3832	3872	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 8:51:04 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NetAdapterCim provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3888; ProviderPath = %systemroot%\system32\wbem\NetAdapterCim.dll	5857	0	4611686018427387904	239	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	3888	3916	WIN-5T344G8GM1H	S-1-5-19	1/19/2018 8:51:04 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3832; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll	5857	0	4611686018427387904	238	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	3832	3872	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 8:51:04 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3832; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll	5857	0	4611686018427387904	237	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	3832	3860	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 8:51:04 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4796; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll	5857	0	4611686018427387904	236	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	4796	840	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 8:45:55 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2284; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll	5857	0	4611686018427387904	235	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2284	2676	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:44:15 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
nettcpip provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2548; ProviderPath = %systemroot%\system32\wbem\NetTCPIP.dll	5857	0	4611686018427387904	234	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2548	2728	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 8:44:08 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NetAdapterCim provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2300; ProviderPath = %systemroot%\system32\wbem\NetAdapterCim.dll	5857	0	4611686018427387904	233	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2300	4360	WIN-5T344G8GM1H	S-1-5-19	1/19/2018 8:44:08 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2548; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll	5857	0	4611686018427387904	232	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2548	2728	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 8:44:08 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2548; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll	5857	0	4611686018427387904	231	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2548	3736	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 8:44:08 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1052; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll	5857	0	4611686018427387904	230	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	1052	4868	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 8:36:56 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3184; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll	5857	0	4611686018427387904	229	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	3184	404	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:34:15 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Win32_WIN32_TERMINALSERVICE_Prov provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1164; ProviderPath = %SystemRoot%\system32\tscfgwmi.dll	5857	0	4611686018427387904	228	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	1164	4616	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 8:34:14 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4600; Component = Unknown; Operation = Start IWbemServices::ExecQuery - ROOT\WMI : SELECT * FROM BatteryStaticData; ResultCode = 0x80041010; PossibleCause = Unknown	5858	2	4611686018427387904	227	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	964	4904	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:34:14 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4600; Component = Unknown; Operation = Start IWbemServices::ExecQuery - ROOT\WMI : SELECT * FROM BatteryFullChargedCapacity; ResultCode = 0x80041010; PossibleCause = Unknown	5858	2	4611686018427387904	226	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	964	4904	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:34:13 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
PowerWmiProvider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1164; ProviderPath = %SYSTEMROOT%\system32\PowerWmiProvider.dll	5857	0	4611686018427387904	225	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	1164	1368	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 8:34:13 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
StorageWMI provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1164; ProviderPath = %SystemRoot%\System32\storagewmi.dll	5857	0	4611686018427387904	224	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	1164	1368	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 8:34:11 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
MSVDS__PROVIDER provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1164; ProviderPath = %systemroot%\system32\wbem\vdswmi.dll	5857	0	4611686018427387904	223	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	1164	1368	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 8:34:11 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
nettcpip provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1164; ProviderPath = %systemroot%\system32\wbem\NetTCPIP.dll	5857	0	4611686018427387904	222	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	1164	1368	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 8:34:08 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NetAdapterCim provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2920; ProviderPath = %systemroot%\system32\wbem\NetAdapterCim.dll	5857	0	4611686018427387904	221	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2920	4532	WIN-5T344G8GM1H	S-1-5-19	1/19/2018 8:34:08 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1164; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll	5857	0	4611686018427387904	220	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	1164	1368	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 8:34:08 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1164; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll	5857	0	4611686018427387904	219	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	1164	1532	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 8:34:08 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9A81CB05-910F-0003-8ACC-819A0F91D301}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 964; Component = Unknown; Operation = Start IWbemServices::ExecNotificationQuery - ROOT\CIMV2 : SELECT * FROM Win32_ProcessStartTrace WHERE ProcessName = 'wsmprovhost.exe'; ResultCode = 0x80041032; PossibleCause = Unknown	5858	2	4611686018427387904	218	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	964	4228	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:33:15 AM	9a81cb05-910f-0003-8acc-819a0f91d301	microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3976; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\Microsoft\Windows\DeviceGuard : SELECT RequiredSecurityProperties FROM Win32_DeviceGuard ; ResultCode = 0x80041032; PossibleCause = Unknown	5858	2	4611686018427387904	217	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	964	1824	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:33:01 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3976; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\Microsoft\Windows\DeviceGuard : SELECT SecurityServicesConfigured FROM Win32_DeviceGuard ; ResultCode = 0x80041032; PossibleCause = Unknown	5858	2	4611686018427387904	216	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	964	5076	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:33:01 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Win32_TpmProvider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1164; ProviderPath = C:\Windows\system32\wbem\Win32_TPM.dll	5857	0	4611686018427387904	215	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	1164	1532	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 8:33:01 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3976; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\Microsoft\Windows\DeviceGuard : SELECT VirtualizationBasedSecurityStatus FROM Win32_DeviceGuard ; ResultCode = 0x80041032; PossibleCause = Unknown	5858	2	4611686018427387904	214	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	964	5076	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:33:01 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3976; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\Microsoft\Windows\DeviceGuard : SELECT SecurityServicesRunning FROM Win32_DeviceGuard ; ResultCode = 0x80041032; PossibleCause = Unknown	5858	2	4611686018427387904	213	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	964	5076	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:33:01 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3976; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\Microsoft\Windows\DeviceGuard : SELECT AvailableSecurityProperties FROM Win32_DeviceGuard ; ResultCode = 0x80041032; PossibleCause = Unknown	5858	2	4611686018427387904	212	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	964	1824	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:33:01 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3976; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\Microsoft\Windows\DeviceGuard : SELECT RequiredSecurityProperties FROM Win32_DeviceGuard ; ResultCode = 0x80041032; PossibleCause = Unknown	5858	2	4611686018427387904	211	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	964	5076	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:33:01 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Win32_DeviceGuard provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1164; ProviderPath = %SystemRoot%\System32\Win32_DeviceGuard.dll	5857	0	4611686018427387904	210	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	1164	1532	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 8:33:01 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3976; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\CIMV2 : SELECT SMBIOSAssetTag FROM Win32_SystemEnclosure ; ResultCode = 0x80041032; PossibleCause = Unknown	5858	2	4611686018427387904	209	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	964	5076	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:32:59 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
MSVDS__PROVIDER provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1164; ProviderPath = %systemroot%\system32\wbem\vdswmi.dll	5857	0	4611686018427387904	208	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	1164	1532	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 8:32:59 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1164; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll	5857	0	4611686018427387904	207	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	1164	2868	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 8:32:58 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1912; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll	5857	0	4611686018427387904	206	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	1912	3084	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:32:58 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
ServerFeatureProvider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1164; ProviderPath = %windir%\system32\wbem\servercompprov.dll	5857	0	4611686018427387904	205	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	1164	1532	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 8:32:58 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
MSVDS__PROVIDER provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 996; ProviderPath = %systemroot%\system32\wbem\vdswmi.dll	5857	0	4611686018427387904	204	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	996	456	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 8:29:00 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 996; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll	5857	0	4611686018427387904	203	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	996	456	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 8:29:00 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WMIProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4324; ProviderPath = %systemroot%\system32\wbem\wmiprov.dll	5857	0	4611686018427387904	202	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	4324	3568	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:27:56 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Namespace = ROOT\CIMV2; NotificationQuery = SELECT * FROM Win32_ProcessStartTrace WHERE ProcessName = 'wsmprovhost.exe'; UserName = ; ClientProcessID = 964, ClientMachine = WIN-5T344G8GM1H; PossibleCause = Temporary	5860	0	4611686018427387904	201	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	964	3260	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:26:55 AM	9a81cb05-910f-0000-a4cc-819a0f91d301	microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WMI Kernel Trace Event Provider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 964; ProviderPath = C:\Windows\System32\wbem\krnlprov.dll	5857	0	4611686018427387904	200	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	964	3260	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:26:55 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
MSVDS__PROVIDER provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3772; ProviderPath = %systemroot%\system32\wbem\vdswmi.dll	5857	0	4611686018427387904	199	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	3772	3768	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 8:26:50 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3772; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll	5857	0	4611686018427387904	198	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	3772	3768	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 8:25:57 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Namespace = //./root/CIMV2; NotificationQuery = select * from MSFT_SCMEventLogEvent; OwnerName = S-1-5-32-544; HostProcessID = 964; Provider= SCM Event Provider, queryID = 0; PossibleCause = Permanent	5859	0	4611686018427387904	197	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	964	4648	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:25:52 AM	9a81cb05-910f-0003-4bcc-819a0f91d301	microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Namespace = //./root/subscription; Eventfilter = SCM Event Log Filter (refer to its activate eventid:5859); Consumer = NTEventLogEventConsumer="SCM Event Log Consumer"; PossibleCause = Binding EventFilter: instance of __EventFilter { CreatorSID = {1, 2, 0, 0, 0, 0, 0, 5, 32, 0, 0, 0, 32, 2, 0, 0}; EventNamespace = "root\\cimv2"; Name = "SCM Event Log Filter"; Query = "select * from MSFT_SCMEventLogEvent"; QueryLanguage = "WQL"; }; Perm. Consumer: instance of NTEventLogEventConsumer { Category = 0; CreatorSID = {1, 2, 0, 0, 0, 0, 0, 5, 32, 0, 0, 0, 32, 2, 0, 0}; EventType = 1; Name = "SCM Event Log Consumer"; NameOfUserSIDProperty = "sid"; SourceName = "Service Control Manager"; };	5861	0	4611686018427387904	196	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	964	4648	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:25:52 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
MSVDS__PROVIDER provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3772; ProviderPath = %systemroot%\system32\wbem\vdswmi.dll	5857	0	4611686018427387904	195	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	3772	3768	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 8:24:46 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4124; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll	5857	0	4611686018427387904	194	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	4124	4152	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:24:15 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
nettcpip provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3772; ProviderPath = %systemroot%\system32\wbem\NetTCPIP.dll	5857	0	4611686018427387904	193	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	3772	3820	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 8:24:08 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NetAdapterCim provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3084; ProviderPath = %systemroot%\system32\wbem\NetAdapterCim.dll	5857	0	4611686018427387904	192	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	3084	3436	WIN-5T344G8GM1H	S-1-5-19	1/19/2018 8:24:08 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3772; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll	5857	0	4611686018427387904	191	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	3772	3800	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 8:24:08 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32a provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3772; ProviderPath = %systemroot%\system32\wbem\wmipcima.dll	5857	0	4611686018427387904	190	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	3772	3800	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 8:24:03 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3772; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll	5857	0	4611686018427387904	189	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	3772	3800	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 8:24:03 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3868; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll	5857	0	4611686018427387904	188	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	3868	3176	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 6:37:16 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
nettcpip provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2504; ProviderPath = %systemroot%\system32\wbem\NetTCPIP.dll	5857	0	4611686018427387904	187	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2504	2192	WIN-5T344G8GM1H	S-1-5-20	1/16/2018 6:37:14 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NetAdapterCim provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2788; ProviderPath = %systemroot%\system32\wbem\NetAdapterCim.dll	5857	0	4611686018427387904	186	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2788	2624	WIN-5T344G8GM1H	S-1-5-19	1/16/2018 6:37:14 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2504; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll	5857	0	4611686018427387904	185	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2504	2192	WIN-5T344G8GM1H	S-1-5-20	1/16/2018 6:37:14 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2504; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll	5857	0	4611686018427387904	184	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2504	2440	WIN-5T344G8GM1H	S-1-5-20	1/16/2018 6:37:14 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4024; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll	5857	0	4611686018427387904	183	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	4024	3868	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 6:27:16 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
nettcpip provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1288; ProviderPath = %systemroot%\system32\wbem\NetTCPIP.dll	5857	0	4611686018427387904	182	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	1288	3280	WIN-5T344G8GM1H	S-1-5-20	1/16/2018 6:27:14 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NetAdapterCim provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1500; ProviderPath = %systemroot%\system32\wbem\NetAdapterCim.dll	5857	0	4611686018427387904	181	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	1500	2664	WIN-5T344G8GM1H	S-1-5-19	1/16/2018 6:27:14 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1288; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll	5857	0	4611686018427387904	180	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	1288	3280	WIN-5T344G8GM1H	S-1-5-20	1/16/2018 6:27:14 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1288; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll	5857	0	4611686018427387904	179	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	1288	4056	WIN-5T344G8GM1H	S-1-5-20	1/16/2018 6:27:14 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 652; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll	5857	0	4611686018427387904	178	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	652	1972	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 6:17:16 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
nettcpip provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4032; ProviderPath = %systemroot%\system32\wbem\NetTCPIP.dll	5857	0	4611686018427387904	177	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	4032	3152	WIN-5T344G8GM1H	S-1-5-20	1/16/2018 6:17:14 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NetAdapterCim provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3688; ProviderPath = %systemroot%\system32\wbem\NetAdapterCim.dll	5857	0	4611686018427387904	176	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	3688	3124	WIN-5T344G8GM1H	S-1-5-19	1/16/2018 6:17:14 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4032; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll	5857	0	4611686018427387904	175	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	4032	1184	WIN-5T344G8GM1H	S-1-5-20	1/16/2018 6:17:14 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4032; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll	5857	0	4611686018427387904	174	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	4032	1160	WIN-5T344G8GM1H	S-1-5-20	1/16/2018 6:17:14 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WMIProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1088; ProviderPath = %systemroot%\system32\wbem\wmiprov.dll	5857	0	4611686018427387904	173	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	1088	4088	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 6:10:25 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2784; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll	5857	0	4611686018427387904	172	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2784	1752	WIN-5T344G8GM1H	S-1-5-20	1/16/2018 6:08:29 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Namespace = //./root/CIMV2; NotificationQuery = select * from MSFT_SCMEventLogEvent; OwnerName = S-1-5-32-544; HostProcessID = 1176; Provider= SCM Event Provider, queryID = 0; PossibleCause = Permanent	5859	0	4611686018427387904	171	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	1176	3928	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 6:08:20 PM	b65c0852-8ef4-0003-8709-5cb6f48ed301	microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Namespace = //./root/subscription; Eventfilter = SCM Event Log Filter (refer to its activate eventid:5859); Consumer = NTEventLogEventConsumer="SCM Event Log Consumer"; PossibleCause = Binding EventFilter: instance of __EventFilter { CreatorSID = {1, 2, 0, 0, 0, 0, 0, 5, 32, 0, 0, 0, 32, 2, 0, 0}; EventNamespace = "root\\cimv2"; Name = "SCM Event Log Filter"; Query = "select * from MSFT_SCMEventLogEvent"; QueryLanguage = "WQL"; }; Perm. Consumer: instance of NTEventLogEventConsumer { Category = 0; CreatorSID = {1, 2, 0, 0, 0, 0, 0, 5, 32, 0, 0, 0, 32, 2, 0, 0}; EventType = 1; Name = "SCM Event Log Consumer"; NameOfUserSIDProperty = "sid"; SourceName = "Service Control Manager"; };	5861	0	4611686018427387904	170	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	1176	3928	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 6:08:20 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
MSVDS__PROVIDER provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2784; ProviderPath = %systemroot%\system32\wbem\vdswmi.dll	5857	0	4611686018427387904	169	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2784	1752	WIN-5T344G8GM1H	S-1-5-20	1/16/2018 6:07:37 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32a provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2784; ProviderPath = %systemroot%\system32\wbem\wmipcima.dll	5857	0	4611686018427387904	168	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2784	1752	WIN-5T344G8GM1H	S-1-5-20	1/16/2018 6:07:36 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
nettcpip provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2784; ProviderPath = %systemroot%\system32\wbem\NetTCPIP.dll	5857	0	4611686018427387904	167	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2784	4072	WIN-5T344G8GM1H	S-1-5-20	1/16/2018 6:07:14 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NetAdapterCim provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4076; ProviderPath = %systemroot%\system32\wbem\NetAdapterCim.dll	5857	0	4611686018427387904	166	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	4076	1920	WIN-5T344G8GM1H	S-1-5-19	1/16/2018 6:07:14 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2784; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll	5857	0	4611686018427387904	165	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2784	4060	WIN-5T344G8GM1H	S-1-5-20	1/16/2018 6:07:14 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2784; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll	5857	0	4611686018427387904	164	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2784	2824	WIN-5T344G8GM1H	S-1-5-20	1/16/2018 6:07:14 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 2584; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\Microsoft\Windows\DeviceGuard : SELECT AvailableSecurityProperties FROM Win32_DeviceGuard ; ResultCode = 0x80041032; PossibleCause = Unknown	5858	2	4611686018427387904	163	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	1176	2580	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 6:06:34 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 2584; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\Microsoft\Windows\DeviceGuard : SELECT RequiredSecurityProperties FROM Win32_DeviceGuard ; ResultCode = 0x80041032; PossibleCause = Unknown	5858	2	4611686018427387904	162	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	1176	2580	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 6:06:34 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 2584; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\Microsoft\Windows\DeviceGuard : SELECT SecurityServicesConfigured FROM Win32_DeviceGuard ; ResultCode = 0x80041032; PossibleCause = Unknown	5858	2	4611686018427387904	161	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	1176	2640	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 6:06:34 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Win32_TpmProvider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2784; ProviderPath = C:\Windows\system32\wbem\Win32_TPM.dll	5857	0	4611686018427387904	160	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2784	2824	WIN-5T344G8GM1H	S-1-5-20	1/16/2018 6:06:34 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 2584; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\Microsoft\Windows\DeviceGuard : SELECT VirtualizationBasedSecurityStatus FROM Win32_DeviceGuard ; ResultCode = 0x80041032; PossibleCause = Unknown	5858	2	4611686018427387904	159	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	1176	2640	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 6:06:33 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 2584; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\Microsoft\Windows\DeviceGuard : SELECT SecurityServicesRunning FROM Win32_DeviceGuard ; ResultCode = 0x80041032; PossibleCause = Unknown	5858	2	4611686018427387904	158	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	1176	2580	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 6:06:33 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 2584; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\Microsoft\Windows\DeviceGuard : SELECT SecurityServicesRunning FROM Win32_DeviceGuard ; ResultCode = 0x80041032; PossibleCause = Unknown	5858	2	4611686018427387904	157	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	1176	2580	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 6:06:33 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 2584; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\Microsoft\Windows\DeviceGuard : SELECT AvailableSecurityProperties FROM Win32_DeviceGuard ; ResultCode = 0x80041032; PossibleCause = Unknown	5858	2	4611686018427387904	156	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	1176	2580	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 6:06:33 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 2584; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\Microsoft\Windows\DeviceGuard : SELECT RequiredSecurityProperties FROM Win32_DeviceGuard ; ResultCode = 0x80041032; PossibleCause = Unknown	5858	2	4611686018427387904	155	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	1176	2580	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 6:06:33 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Win32_DeviceGuard provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2784; ProviderPath = %SystemRoot%\System32\Win32_DeviceGuard.dll	5857	0	4611686018427387904	154	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2784	2824	WIN-5T344G8GM1H	S-1-5-20	1/16/2018 6:06:33 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 2584; Component = Unknown; Operation = Start IWbemServices::ExecQuery - ROOT\CIMV2 : select ChassisTypes from Win32_SystemEnclosure; ResultCode = 0x80041032; PossibleCause = Unknown	5858	2	4611686018427387904	153	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	1176	2640	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 6:06:33 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2784; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll	5857	0	4611686018427387904	152	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2784	2824	WIN-5T344G8GM1H	S-1-5-20	1/16/2018 6:06:32 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 2584; Component = Unknown; Operation = Start IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT ID FROM Win32_ServerFeature; ResultCode = 0x80041032; PossibleCause = Unknown	5858	2	4611686018427387904	151	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	1176	2640	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 6:06:32 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2832; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll	5857	0	4611686018427387904	150	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2832	2860	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 6:06:27 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
ServerFeatureProvider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2784; ProviderPath = %windir%\system32\wbem\servercompprov.dll	5857	0	4611686018427387904	149	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2784	2812	WIN-5T344G8GM1H	S-1-5-20	1/16/2018 6:06:27 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4892; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll	5857	0	4611686018427387904	148	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	4892	836	WIN-5T344G8GM1H	S-1-5-20	1/16/2018 6:02:36 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4256; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll	5857	0	4611686018427387904	147	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	4256	4144	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:53:30 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
nettcpip provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4976; ProviderPath = %systemroot%\system32\wbem\NetTCPIP.dll	5857	0	4611686018427387904	146	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	4976	3800	WIN-5T344G8GM1H	S-1-5-20	1/16/2018 5:53:24 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NetAdapterCim provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 5092; ProviderPath = %systemroot%\system32\wbem\NetAdapterCim.dll	5857	0	4611686018427387904	145	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	5092	2628	WIN-5T344G8GM1H	S-1-5-19	1/16/2018 5:53:24 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4976; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll	5857	0	4611686018427387904	144	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	4976	3800	WIN-5T344G8GM1H	S-1-5-20	1/16/2018 5:53:23 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4976; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll	5857	0	4611686018427387904	143	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	4976	5116	WIN-5T344G8GM1H	S-1-5-20	1/16/2018 5:53:23 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {53B2B737-8EF1-0000-6DB9-B253F18ED301}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 1152; Component = Unknown; Operation = Start IWbemServices::ExecNotificationQuery - ROOT\CIMV2 : SELECT * FROM Win32_ProcessStartTrace WHERE ProcessName = 'wsmprovhost.exe'; ResultCode = 0x80041032; PossibleCause = Unknown	5858	2	4611686018427387904	142	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	1152	4780	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:50:11 PM	53b2b737-8ef1-0000-6db9-b253f18ed301	microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WMIProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3688; ProviderPath = %systemroot%\system32\wbem\wmiprov.dll	5857	0	4611686018427387904	141	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	3688	2160	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:46:15 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Namespace = ROOT\CIMV2; NotificationQuery = SELECT * FROM Win32_ProcessStartTrace WHERE ProcessName = 'wsmprovhost.exe'; UserName = ; ClientProcessID = 1152, ClientMachine = WIN-5T344G8GM1H; PossibleCause = Temporary	5860	0	4611686018427387904	140	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	1152	4676	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:44:23 PM	53b2b737-8ef1-0003-feb9-b253f18ed301	microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WMI Kernel Trace Event Provider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1152; ProviderPath = C:\Windows\System32\wbem\krnlprov.dll	5857	0	4611686018427387904	139	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	1152	4676	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:44:23 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 400; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_ComputerSystemProduct; ResultCode = 0x80041032; PossibleCause = Unknown	5858	2	4611686018427387904	138	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	1152	2600	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:44:12 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4212; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll	5857	0	4611686018427387904	137	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	4212	4236	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:43:31 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
MSVDS__PROVIDER provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 976; ProviderPath = %systemroot%\system32\wbem\vdswmi.dll	5857	0	4611686018427387904	136	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	976	2796	WIN-5T344G8GM1H	S-1-5-20	1/16/2018 5:43:29 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
nettcpip provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 976; ProviderPath = %systemroot%\system32\wbem\NetTCPIP.dll	5857	0	4611686018427387904	135	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	976	3216	WIN-5T344G8GM1H	S-1-5-20	1/16/2018 5:43:23 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NetAdapterCim provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3208; ProviderPath = %systemroot%\system32\wbem\NetAdapterCim.dll	5857	0	4611686018427387904	134	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	3208	3308	WIN-5T344G8GM1H	S-1-5-19	1/16/2018 5:43:23 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 976; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll	5857	0	4611686018427387904	133	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	976	324	WIN-5T344G8GM1H	S-1-5-20	1/16/2018 5:43:23 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32a provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 976; ProviderPath = %systemroot%\system32\wbem\wmipcima.dll	5857	0	4611686018427387904	132	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	976	324	WIN-5T344G8GM1H	S-1-5-20	1/16/2018 5:43:17 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 976; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll	5857	0	4611686018427387904	131	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	976	324	WIN-5T344G8GM1H	S-1-5-20	1/16/2018 5:43:17 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Namespace = //./root/CIMV2; NotificationQuery = select * from MSFT_SCMEventLogEvent; OwnerName = S-1-5-32-544; HostProcessID = 1152; Provider= SCM Event Provider, queryID = 0; PossibleCause = Permanent	5859	0	4611686018427387904	130	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	1152	2720	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:42:38 PM	53b2b737-8ef1-0001-8eb7-b253f18ed301	microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Namespace = //./root/subscription; Eventfilter = SCM Event Log Filter (refer to its activate eventid:5859); Consumer = NTEventLogEventConsumer="SCM Event Log Consumer"; PossibleCause = Binding EventFilter: instance of __EventFilter { CreatorSID = {1, 2, 0, 0, 0, 0, 0, 5, 32, 0, 0, 0, 32, 2, 0, 0}; EventNamespace = "root\\cimv2"; Name = "SCM Event Log Filter"; Query = "select * from MSFT_SCMEventLogEvent"; QueryLanguage = "WQL"; }; Perm. Consumer: instance of NTEventLogEventConsumer { Category = 0; CreatorSID = {1, 2, 0, 0, 0, 0, 0, 5, 32, 0, 0, 0, 32, 2, 0, 0}; EventType = 1; Name = "SCM Event Log Consumer"; NameOfUserSIDProperty = "sid"; SourceName = "Service Control Manager"; };	5861	0	4611686018427387904	129	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	1152	2720	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:42:38 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {A4626349-8EA8-0003-B36D-62A4A88ED301}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::ExecNotificationQuery - ROOT\CIMV2 : SELECT * FROM Win32_ProcessStartTrace WHERE ProcessName = 'wsmprovhost.exe'; ResultCode = 0x80041032; PossibleCause = Unknown	5858	2	4611686018427387904	128	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	3696	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:37:24 PM	a4626349-8ea8-0003-b36d-62a4a88ed301	microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 164; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll	5857	0	4611686018427387904	127	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	164	3628	WIN-5T344G8GM1H	S-1-5-20	1/16/2018 5:35:48 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WmiPerfInst provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3868; ProviderPath = C:\Windows\System32\wbem\WmiPerfInst.dll	5857	0	4611686018427387904	126	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	3868	1388	WIN-5T344G8GM1H	S-1-5-19	1/16/2018 5:35:07 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WMIProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4924; ProviderPath = %systemroot%\system32\wbem\wmiprov.dll	5857	0	4611686018427387904	125	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	4924	428	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:35:04 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WmiPerfClass provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4924; ProviderPath = C:\Windows\System32\wbem\WmiPerfClass.dll	5857	0	4611686018427387904	124	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	4924	5928	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:35:03 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Namespace = ROOT\CIMV2; NotificationQuery = SELECT * FROM Win32_ProcessStartTrace WHERE ProcessName = 'wsmprovhost.exe'; UserName = ; ClientProcessID = 924, ClientMachine = WIN-5T344G8GM1H; PossibleCause = Temporary	5860	0	4611686018427387904	123	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2052	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:34:06 PM	a4626349-8ea8-0002-ed6e-62a4a88ed301	microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WMI Kernel Trace Event Provider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 924; ProviderPath = C:\Windows\System32\wbem\krnlprov.dll	5857	0	4611686018427387904	122	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2052	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:34:06 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 5028; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll	5857	0	4611686018427387904	121	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	5028	5328	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:32:53 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
nettcpip provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 5804; ProviderPath = %systemroot%\system32\wbem\NetTCPIP.dll	5857	0	4611686018427387904	120	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	5804	5824	WIN-5T344G8GM1H	S-1-5-20	1/16/2018 5:32:40 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NetAdapterCim provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3816; ProviderPath = %systemroot%\system32\wbem\NetAdapterCim.dll	5857	0	4611686018427387904	119	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	3816	1224	WIN-5T344G8GM1H	S-1-5-19	1/16/2018 5:32:40 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 5804; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll	5857	0	4611686018427387904	118	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	5804	5824	WIN-5T344G8GM1H	S-1-5-20	1/16/2018 5:32:40 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 5804; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll	5857	0	4611686018427387904	117	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	5804	912	WIN-5T344G8GM1H	S-1-5-20	1/16/2018 5:32:40 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3180; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll	5857	0	4611686018427387904	116	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	3180	804	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:22:47 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
nettcpip provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3772; ProviderPath = %systemroot%\system32\wbem\NetTCPIP.dll	5857	0	4611686018427387904	115	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	3772	5300	WIN-5T344G8GM1H	S-1-5-20	1/16/2018 5:22:40 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NetAdapterCim provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 888; ProviderPath = %systemroot%\system32\wbem\NetAdapterCim.dll	5857	0	4611686018427387904	114	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	888	5288	WIN-5T344G8GM1H	S-1-5-19	1/16/2018 5:22:40 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3772; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll	5857	0	4611686018427387904	113	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	3772	5300	WIN-5T344G8GM1H	S-1-5-20	1/16/2018 5:22:40 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3772; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll	5857	0	4611686018427387904	112	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	3772	3704	WIN-5T344G8GM1H	S-1-5-20	1/16/2018 5:22:40 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 5964; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll	5857	0	4611686018427387904	111	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	5964	3468	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:12:54 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {A4626349-8EA8-0000-8A6D-62A4A88ED301}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::ExecNotificationQuery - ROOT\CIMV2 : SELECT * FROM Win32_ProcessStartTrace WHERE ProcessName = 'wsmprovhost.exe'; ResultCode = 0x80041032; PossibleCause = Unknown	5858	2	4611686018427387904	110	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	1992	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:12:41 PM	a4626349-8ea8-0000-8a6d-62a4a88ed301	microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
nettcpip provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1260; ProviderPath = %systemroot%\system32\wbem\NetTCPIP.dll	5857	0	4611686018427387904	109	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	1260	1960	WIN-5T344G8GM1H	S-1-5-20	1/16/2018 5:12:40 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NetAdapterCim provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2736; ProviderPath = %systemroot%\system32\wbem\NetAdapterCim.dll	5857	0	4611686018427387904	108	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2736	2320	WIN-5T344G8GM1H	S-1-5-19	1/16/2018 5:12:40 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1260; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll	5857	0	4611686018427387904	107	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	1260	1960	WIN-5T344G8GM1H	S-1-5-20	1/16/2018 5:12:40 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1260; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll	5857	0	4611686018427387904	106	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	1260	1936	WIN-5T344G8GM1H	S-1-5-20	1/16/2018 5:12:40 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Namespace = ROOT\CIMV2; NotificationQuery = SELECT * FROM Win32_ProcessStartTrace WHERE ProcessName = 'wsmprovhost.exe'; UserName = ; ClientProcessID = 924, ClientMachine = WIN-5T344G8GM1H; PossibleCause = Temporary	5860	0	4611686018427387904	105	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	3016	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:06:17 PM	a4626349-8ea8-0003-146c-62a4a88ed301	microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WMI Kernel Trace Event Provider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 924; ProviderPath = C:\Windows\System32\wbem\krnlprov.dll	5857	0	4611686018427387904	104	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	3016	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:06:17 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
MSVDS__PROVIDER provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3428; ProviderPath = %systemroot%\system32\wbem\vdswmi.dll	5857	0	4611686018427387904	103	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	3428	5844	WIN-5T344G8GM1H	S-1-5-20	1/16/2018 5:06:06 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3428; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll	5857	0	4611686018427387904	102	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	3428	5844	WIN-5T344G8GM1H	S-1-5-20	1/16/2018 5:06:06 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WMIProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2768; ProviderPath = %systemroot%\system32\wbem\wmiprov.dll	5857	0	4611686018427387904	101	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2768	1104	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:05:59 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2856; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll	5857	0	4611686018427387904	100	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2856	3704	WIN-5T344G8GM1H	S-1-5-20	1/16/2018 5:04:01 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Namespace = //./root/CIMV2; NotificationQuery = select * from MSFT_SCMEventLogEvent; OwnerName = S-1-5-32-544; HostProcessID = 924; Provider= SCM Event Provider, queryID = 0; PossibleCause = Permanent	5859	0	4611686018427387904	99	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	3356	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:03:48 PM	a4626349-8ea8-0003-c36b-62a4a88ed301	microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Namespace = //./root/subscription; Eventfilter = SCM Event Log Filter (refer to its activate eventid:5859); Consumer = NTEventLogEventConsumer="SCM Event Log Consumer"; PossibleCause = Binding EventFilter: instance of __EventFilter { CreatorSID = {1, 2, 0, 0, 0, 0, 0, 5, 32, 0, 0, 0, 32, 2, 0, 0}; EventNamespace = "root\\cimv2"; Name = "SCM Event Log Filter"; Query = "select * from MSFT_SCMEventLogEvent"; QueryLanguage = "WQL"; }; Perm. Consumer: instance of NTEventLogEventConsumer { Category = 0; CreatorSID = {1, 2, 0, 0, 0, 0, 0, 5, 32, 0, 0, 0, 32, 2, 0, 0}; EventType = 1; Name = "SCM Event Log Consumer"; NameOfUserSIDProperty = "sid"; SourceName = "Service Control Manager"; };	5861	0	4611686018427387904	98	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	1768	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:03:48 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
MSVDS__PROVIDER provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2856; ProviderPath = %systemroot%\system32\wbem\vdswmi.dll	5857	0	4611686018427387904	97	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2856	3704	WIN-5T344G8GM1H	S-1-5-20	1/16/2018 5:02:51 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
nettcpip provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2856; ProviderPath = %systemroot%\system32\wbem\NetTCPIP.dll	5857	0	4611686018427387904	96	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2856	812	WIN-5T344G8GM1H	S-1-5-20	1/16/2018 5:02:39 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NetAdapterCim provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 5960; ProviderPath = %systemroot%\system32\wbem\NetAdapterCim.dll	5857	0	4611686018427387904	95	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	5960	5988	WIN-5T344G8GM1H	S-1-5-19	1/16/2018 5:02:39 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2856; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll	5857	0	4611686018427387904	94	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2856	3084	WIN-5T344G8GM1H	S-1-5-20	1/16/2018 5:02:39 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 2972; Component = Unknown; Operation = Start IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT ID FROM Win32_ServerFeature; ResultCode = 0x80041032; PossibleCause = Unknown	5858	2	4611686018427387904	93	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2352	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:13 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{FB2CA36D-0B40-4307-821B-A13B252DE56C}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	92	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2512	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:11 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{F9C77450-3A41-477E-9310-9ACD617BD9E3}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	91	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2512	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:11 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{E62688F0-25FD-4c90-BFF5-F508B9D2E31F}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	90	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2512	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:11 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{E5094040-C46C-4115-B030-04FB2E545B00}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	89	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2512	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:11 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{E4F48E54-F38D-4884-BFB9-D4D2E5729C18}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	88	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2512	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:11 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{E47248BA-94CC-49c4-BBB5-9EB7F05183D0}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	87	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2512	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:11 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{CF7639F3-ABA2-41DB-97F2-81E2C5DBFC5D}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	86	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2512	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:11 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{c6dc5466-785a-11d2-84d0-00c04fb169f7}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	85	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2512	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:11 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{C631DF4C-088F-4156-B058-4375F0853CD8}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	84	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2512	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:11 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{C418DD9D-0D14-4efb-8FBF-CFE535C8FAC7}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	83	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2512	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:11 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{C34B2751-1CF4-44F5-9262-C3FC39666591}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	82	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2512	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:11 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{BC75B1ED-5833-4858-9BB8-CBF0B166DF9D}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	81	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2512	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:11 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{BA649533-0AAC-4E04-B9BC-4DBAE0325B12}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	80	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2512	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:11 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{B087BE9D-ED37-454f-AF9C-04291E351182}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	79	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2512	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:11 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{AADCED64-746C-4633-A97C-D61349046527}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	78	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2512	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:11 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{A3F3E39B-5D83-4940-B954-28315B82F0A8}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	77	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2512	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:11 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{91FBB303-0CD5-4055-BF42-E512A681B325}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	76	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2512	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:11 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{8A28E2C5-8D06-49A4-A08C-632DAA493E17}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	75	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2512	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:11 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{7B849a69-220F-451E-B3FE-2CB811AF94AE}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	74	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2512	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:11 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{7933F41E-56F8-41d6-A31C-4148A711EE93}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	73	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2512	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:11 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{74EE6C03-5363-4554-B161-627540339CAB}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	72	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2512	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:11 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{728EE579-943C-4519-9EF7-AB56765798ED}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	71	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2512	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:11 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{7150F9BF-48AD-4da4-A49C-29EF4A8369BA}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	70	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2512	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:11 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{6232C319-91AC-4931-9385-E70C2B099F0E}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	69	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2512	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:11 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{5794DAFD-BE60-433f-88A2-1A31939AC01F}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	68	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2512	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:11 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{4D2F9B6F-1E52-4711-A382-6A8B1A003DE6}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	67	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2512	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:11 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{4CFB60C1-FAA6-47f1-89AA-0B18730C9FD3}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	66	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2512	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:11 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{4B7C3B0F-E993-4E06-A241-3FBE06943684}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	65	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2512	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:11 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{42B5FAAE-6536-11d2-AE5A-0000F87571E3}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	64	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2512	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:11 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{3A0DBA37-F8B2-4356-83DE-3E90BD5C261F}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	63	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2512	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:11 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{2BFCC077-22D2-48DE-BDE1-2F618D9B476D}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	62	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2512	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:11 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{25537BA6-77A8-11D2-9B6C-0000F8080861}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	61	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2512	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:11 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{1A6364EB-776B-4120-ADE1-B63A406A76B5}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	60	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2512	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:11 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{17D89FEC-5C44-4972-B12D-241CAEF74509}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	59	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2512	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:11 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{169EBF44-942F-4C43-87CE-13C93996EBBE}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	58	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2512	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:11 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{0E28E245-9368-4853-AD84-6DA3BA35BB75}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	57	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2512	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:11 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WMIProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2768; ProviderPath = %systemroot%\system32\wbem\wmiprov.dll	5857	0	4611686018427387904	56	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2768	1124	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:11 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WMIProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2768; ProviderPath = %systemroot%\system32\wbem\wmiprov.dll	5857	0	4611686018427387904	55	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2768	1124	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:11 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{FC491EF1-C4AA-4CE1-B329-414B101DB823}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	54	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2528	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:09 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{fbf687e6-f063-4d9f-9f4f-fd9a26acdd5f}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	53	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2528	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:09 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{FB2CA36D-0B40-4307-821B-A13B252DE56C}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	52	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2528	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:09 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{f3ccc681-b74c-4060-9f26-cd84525dca2a}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	51	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2528	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:09 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{F312195E-3D9D-447A-A3F5-08DFFA24735E}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	50	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2528	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:09 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{E62688F0-25FD-4c90-BFF5-F508B9D2E31F}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	49	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2528	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:09 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{E5094040-C46C-4115-B030-04FB2E545B00}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	48	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2528	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:09 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{E4F48E54-F38D-4884-BFB9-D4D2E5729C18}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	47	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2528	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:09 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{e437bc1c-aa7d-11d2-a382-00c04f991e27}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	46	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2528	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:09 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{CF7639F3-ABA2-41DB-97F2-81E2C5DBFC5D}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	45	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2528	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:09 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{cdeafc3d-948d-49dd-ab12-e578ba4af7aa}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	44	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2528	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:09 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{c6dc5466-785a-11d2-84d0-00c04fb169f7}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	43	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2528	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:09 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{C631DF4C-088F-4156-B058-4375F0853CD8}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	42	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2528	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:09 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{C418DD9D-0D14-4efb-8FBF-CFE535C8FAC7}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	41	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2528	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:09 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{C34B2751-1CF4-44F5-9262-C3FC39666591}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	40	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2528	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:09 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{BC75B1ED-5833-4858-9BB8-CBF0B166DF9D}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	39	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2528	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:09 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{BA649533-0AAC-4E04-B9BC-4DBAE0325B12}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	38	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2528	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:09 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{B587E2B1-4D59-4e7e-AED9-22B9DF11D053}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	37	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2528	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:09 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{B087BE9D-ED37-454f-AF9C-04291E351182}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	36	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2528	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:09 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{AADCED64-746C-4633-A97C-D61349046527}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	35	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2528	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:09 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{A3F3E39B-5D83-4940-B954-28315B82F0A8}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	34	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2528	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:09 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{91FBB303-0CD5-4055-BF42-E512A681B325}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	33	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2528	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:09 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{8A28E2C5-8D06-49A4-A08C-632DAA493E17}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	32	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2528	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:09 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{827D319E-6EAC-11D2-A4EA-00C04F79F83A}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	31	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2528	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:09 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{7B849a69-220F-451E-B3FE-2CB811AF94AE}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	30	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2528	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:09 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{7933F41E-56F8-41d6-A31C-4148A711EE93}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	29	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2528	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:09 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{74EE6C03-5363-4554-B161-627540339CAB}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	28	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2528	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:09 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{728EE579-943C-4519-9EF7-AB56765798ED}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	27	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2528	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:09 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{7150F9BF-48AD-4da4-A49C-29EF4A8369BA}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	26	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2528	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:09 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{6A4C88C6-C502-4f74-8F60-2CB23EDC24E2}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	25	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2528	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:09 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{6232C319-91AC-4931-9385-E70C2B099F0E}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	24	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2528	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:09 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{4CFB60C1-FAA6-47f1-89AA-0B18730C9FD3}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	23	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2528	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:09 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{4bcd6cde-777b-48b6-9804-43568e23545d}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	22	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2528	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:09 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{4B7C3B0F-E993-4E06-A241-3FBE06943684}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	21	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2528	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:09 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{42B5FAAE-6536-11d2-AE5A-0000F87571E3}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	20	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2528	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:09 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{426031c0-0b47-4852-b0ca-ac3d37bfcb39}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	19	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2528	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:09 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{3A0DBA37-F8B2-4356-83DE-3E90BD5C261F}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	18	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2528	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:09 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{3610eda5-77ef-11d2-8dc5-00c04fa31a66}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	17	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2528	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:09 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{2BFCC077-22D2-48DE-BDE1-2F618D9B476D}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	16	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2528	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:09 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{2A8FDC61-2347-4C87-92F6-B05EB91A201A}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	15	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2528	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:09 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{1A6364EB-776B-4120-ADE1-B63A406A76B5}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	14	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2528	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:09 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{17D89FEC-5C44-4972-B12D-241CAEF74509}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	13	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2528	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:09 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{16be69fa-4209-4250-88cb-716cf41954e0}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	12	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2528	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:09 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{169EBF44-942F-4C43-87CE-13C93996EBBE}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	11	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2528	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:09 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{0E28E245-9368-4853-AD84-6DA3BA35BB75}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	10	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2528	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:09 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{0ACDD40C-75AC-47ab-BAA0-BF6DE7E7FE63}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	9	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2528	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:09 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{35378EAC-683F-11D2-A89A-00C04FBBCFA2}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	8	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2528	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:09 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3440; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll	5857	0	4611686018427387904	7	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	3440	3468	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:09 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
ServerFeatureProvider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2856; ProviderPath = %windir%\system32\wbem\servercompprov.dll	5857	0	4611686018427387904	6	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2856	3084	WIN-5T344G8GM1H	S-1-5-20	1/16/2018 5:02:09 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 2972; Component = Unknown; Operation = Start IWbemServices::ExecQuery - ROOT\CIMV2 : select ChassisTypes from Win32_SystemEnclosure; ResultCode = 0x80041032; PossibleCause = Unknown	5858	2	4611686018427387904	5	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2484	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:09 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32a provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2856; ProviderPath = %systemroot%\system32\wbem\wmipcima.dll	5857	0	4611686018427387904	4	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2856	3084	WIN-5T344G8GM1H	S-1-5-20	1/16/2018 5:02:06 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2856; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll	5857	0	4611686018427387904	3	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2856	2436	WIN-5T344G8GM1H	S-1-5-20	1/16/2018 5:02:05 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-PD8DQPRRTAO; User = NT AUTHORITY\SYSTEM; ClientProcessId = 2508; Component = Unknown; Operation = Start IWbemServices::CreateInstanceEnum - root\wmi : MSiSCSI_PortalInfoClass; ResultCode = 0x8004100A; PossibleCause = Unknown	5858	2	4611686018427387904	2	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	916	2392	WIN-PD8DQPRRTAO	S-1-5-18	1/16/2018 5:01:40 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-PD8DQPRRTAO; User = NT AUTHORITY\SYSTEM; ClientProcessId = 2508; Component = Unknown; Operation = Start IWbemServices::CreateInstanceEnum - root\wmi : MS_SM_AdapterInformationQuery; ResultCode = 0x8004100A; PossibleCause = Unknown	5858	2	4611686018427387904	1	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	916	2392	WIN-PD8DQPRRTAO	S-1-5-18	1/16/2018 5:01:40 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]