Message	Id	Level	Keywords	RecordId	ProviderName	ProviderId	LogName	ProcessId	ThreadId	MachineName	UserId	TimeCreated	ActivityId	ContainerLog	MatchedQueryIds	Bookmark	LevelDisplayName	OpcodeDisplayName	KeywordsDisplayNames	Properties
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3964; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll	5857	0	4611686018427387904	857	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	3964	2324	hv-cinder-83998	S-1-5-18	4/29/2022 7:03:52 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1416; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll	5857	0	4611686018427387904	856	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	1416	5000	hv-cinder-83998	S-1-5-20	4/29/2022 7:03:52 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {4788929E-BE35-4797-9946-FAE614EA03F3}; ClientMachine = HV-CINDER-83998; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4608; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1058857538; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	855	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	560	4248	hv-cinder-83998	S-1-5-18	4/29/2022 7:03:37 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {A97416B3-BC56-4D98-8E6D-79948D4F5329}; ClientMachine = HV-CINDER-83998; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4608; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{AA65DDDD-72B4-4044-B7FD-AAD1D9C7118E}"; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	854	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	560	2888	hv-cinder-83998	S-1-5-18	4/29/2022 7:03:36 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {6BB5AF8D-5D0A-44D7-9354-8216B727BA38}; ClientMachine = HV-CINDER-83998; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4608; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{0ED3F113-D0C4-436D-8A30-F453812DF94D}"; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	853	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	560	2888	hv-cinder-83998	S-1-5-18	4/29/2022 7:03:35 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {60760404-40E7-4C47-9F9D-B42E25043CE4}; ClientMachine = HV-CINDER-83998; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4608; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{A6536354-21D2-4245-9BBC-7F681222F2DA}"; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	852	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	560	2888	hv-cinder-83998	S-1-5-18	4/29/2022 7:03:34 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {845D4768-CF9E-409F-9472-F0A298548B63}; ClientMachine = HV-CINDER-83998; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4608; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=215644963; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	851	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	560	2888	hv-cinder-83998	S-1-5-18	4/29/2022 7:03:13 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {B05D4DF4-53FE-4044-9B35-BCCF245E1CD8}; ClientMachine = HV-CINDER-83998; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4608; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1402064870; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	850	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	560	3076	hv-cinder-83998	S-1-5-18	4/29/2022 7:03:01 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {CBEFD30B-F5F5-4D63-9717-F3F774EEC4BF}; ClientMachine = HV-CINDER-83998; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4608; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=327615030; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	849	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	560	3076	hv-cinder-83998	S-1-5-18	4/29/2022 7:02:59 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {C497E713-E644-48E7-ABCD-A580085DD919}; ClientMachine = HV-CINDER-83998; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4608; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{349B1891-BCA6-477F-BB11-1C730DBBA99C}"; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	848	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	560	2888	hv-cinder-83998	S-1-5-18	4/29/2022 7:02:58 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {320113A3-12A2-4AED-B7AD-8DBB60222615}; ClientMachine = HV-CINDER-83998; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4608; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1646258285; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	847	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	560	3076	hv-cinder-83998	S-1-5-18	4/29/2022 7:02:58 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {0D975D41-DED8-4100-8DA3-E087D079C240}; ClientMachine = HV-CINDER-83998; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4608; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=547142951; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	846	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	560	2888	hv-cinder-83998	S-1-5-18	4/29/2022 7:02:47 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {8D3B2050-56A4-4699-A396-FF61AF694D71}; ClientMachine = HV-CINDER-83998; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4608; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=243968987; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	845	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	560	3076	hv-cinder-83998	S-1-5-18	4/29/2022 7:02:46 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {1180A4EA-FBEB-4000-89AA-2585EB76DE8A}; ClientMachine = HV-CINDER-83998; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4608; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=271553159; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	844	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	560	3076	hv-cinder-83998	S-1-5-18	4/29/2022 7:02:45 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {3CA04D40-460E-46ED-A04D-BB7ACFBF43F9}; ClientMachine = HV-CINDER-83998; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4608; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=558842252; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	843	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	560	2232	hv-cinder-83998	S-1-5-18	4/29/2022 7:02:37 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {13612222-E7E6-42C2-A52C-59385C69E8D7}; ClientMachine = HV-CINDER-83998; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4608; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{841E640C-70F2-433D-84BC-BBEA1857242D}"; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	842	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	560	2232	hv-cinder-83998	S-1-5-18	4/29/2022 7:02:36 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {A7413FB8-E297-4B37-9D09-78119BD03290}; ClientMachine = HV-CINDER-83998; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4608; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=623661083; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	841	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	560	2888	hv-cinder-83998	S-1-5-18	4/29/2022 7:02:25 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {75B15B01-8D69-4612-950B-D3E5BF92EAFA}; ClientMachine = HV-CINDER-83998; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4608; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=581159280; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	840	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	560	3076	hv-cinder-83998	S-1-5-18	4/29/2022 7:02:23 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {3A3D55E2-92B2-4A42-8A45-6890F0FA7B1B}; ClientMachine = HV-CINDER-83998; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4608; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=2104495454; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	839	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	560	2888	hv-cinder-83998	S-1-5-18	4/29/2022 7:02:22 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {379BC585-D482-46EC-9E74-4E9204F023EC}; ClientMachine = HV-CINDER-83998; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4608; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Host.HostName="iqn.2010-10.org.openstack:volume-de7ecb40-d2f6-478c-9aa6-13002992d97e"; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	838	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	560	3076	hv-cinder-83998	S-1-5-18	4/29/2022 7:02:16 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {0CC447EB-A40B-4578-8A92-30997F5905CA}; ClientMachine = HV-CINDER-83998; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4608; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_IDMethod.HostName="iqn.2010-10.org.openstack:volume-de7ecb40-d2f6-478c-9aa6-13002992d97e",Method=4,Value="iqn.1991-05.com.microsoft:hv-cinder-83998"; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	837	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	560	3076	hv-cinder-83998	S-1-5-18	4/29/2022 7:02:16 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
StorageWMI provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1416; ProviderPath = %SystemRoot%\System32\storagewmi.dll	5857	0	4611686018427387904	836	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	1416	5000	hv-cinder-83998	S-1-5-20	4/29/2022 7:02:08 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
MSVSS__PROVIDER provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1416; ProviderPath = %systemroot%\system32\wbem\vsswmi.dll	5857	0	4611686018427387904	835	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	1416	5000	hv-cinder-83998	S-1-5-20	4/29/2022 7:02:07 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WinTargetProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2832; ProviderPath = C:\windows\system32\wbem\WTWMIProv.dll	5857	0	4611686018427387904	834	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2832	3548	hv-cinder-83998	S-1-5-19	4/29/2022 7:02:06 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {EE4264A0-0B48-4FDE-A0F7-F7851D2E3806}; ClientMachine = HV-CINDER-83998; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4608; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Host.HostName="iqn.2010-10.org.openstack:volume-7fe000ef-a36c-4f43-96eb-fbfcb7641424"; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	833	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	560	3196	hv-cinder-83998	S-1-5-18	4/29/2022 7:00:29 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {8D488903-AC95-43A6-AB5F-1FFBF7C96F4E}; ClientMachine = HV-CINDER-83998; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4608; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_IDMethod.HostName="iqn.2010-10.org.openstack:volume-7fe000ef-a36c-4f43-96eb-fbfcb7641424",Method=4,Value="iqn.1991-05.com.microsoft:hv-cinder-83998"; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	832	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	560	4248	hv-cinder-83998	S-1-5-18	4/29/2022 7:00:29 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
StorageWMI provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1416; ProviderPath = %SystemRoot%\System32\storagewmi.dll	5857	0	4611686018427387904	831	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	1416	5000	hv-cinder-83998	S-1-5-20	4/29/2022 7:00:21 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1416; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll	5857	0	4611686018427387904	830	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	1416	5000	hv-cinder-83998	S-1-5-20	4/29/2022 7:00:21 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
MSVSS__PROVIDER provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1416; ProviderPath = %systemroot%\system32\wbem\vsswmi.dll	5857	0	4611686018427387904	829	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	1416	5000	hv-cinder-83998	S-1-5-20	4/29/2022 7:00:18 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WinTargetProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1116; ProviderPath = C:\windows\system32\wbem\WTWMIProv.dll	5857	0	4611686018427387904	828	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	1116	2044	hv-cinder-83998	S-1-5-19	4/29/2022 7:00:18 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {044830A5-A694-4A8F-822A-3EBDAA196D63}; ClientMachine = HV-CINDER-83998; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4608; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1518943315; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	827	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	560	2520	hv-cinder-83998	S-1-5-18	4/29/2022 6:59:09 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {A5477262-87CD-4225-8E27-3DD167066548}; ClientMachine = HV-CINDER-83998; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4608; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=53271585; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	826	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	560	3196	hv-cinder-83998	S-1-5-18	4/29/2022 6:59:08 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {CD2A1B78-9418-4E82-8802-A171B269957C}; ClientMachine = HV-CINDER-83998; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4608; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=544798172; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	825	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	560	3196	hv-cinder-83998	S-1-5-18	4/29/2022 6:59:07 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {476DFB39-D756-4BE1-9C88-28A172B91312}; ClientMachine = HV-CINDER-83998; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4608; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=2068249720; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	824	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	560	2520	hv-cinder-83998	S-1-5-18	4/29/2022 6:59:06 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9860CC3A-1F07-4049-9899-DF1FE39AA412}; ClientMachine = HV-CINDER-83998; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4608; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{FF82A3B0-DB45-4AE1-8492-7F2EBD9B33F0}"; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	823	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	560	3196	hv-cinder-83998	S-1-5-18	4/29/2022 6:59:04 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {58372B7B-E465-4D33-A818-D3B379BF72E4}; ClientMachine = HV-CINDER-83998; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4608; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1695410026; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	822	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	560	3196	hv-cinder-83998	S-1-5-18	4/29/2022 6:59:04 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {AB7A0DF5-45A3-4CF3-863E-08E2E0A5783C}; ClientMachine = HV-CINDER-83998; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4608; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{7DF122A6-52D7-4A17-9BE5-E415CDC2EC56}"; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	821	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	560	2520	hv-cinder-83998	S-1-5-18	4/29/2022 6:58:56 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {684C86C4-C04B-4A4A-9146-BB5BCFF23F61}; ClientMachine = HV-CINDER-83998; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4608; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1828638525; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	820	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	560	4248	hv-cinder-83998	S-1-5-18	4/29/2022 6:58:54 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {113FC189-8C0F-47C1-B419-6E55D4EF0562}; ClientMachine = HV-CINDER-83998; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4608; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=401161188; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	819	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	560	4872	hv-cinder-83998	S-1-5-18	4/29/2022 6:58:28 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {6E528479-A1EB-4EBB-B034-4ADAFC5C4B73}; ClientMachine = HV-CINDER-83998; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4608; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Host.HostName="iqn.2010-10.org.openstack:volume-6cee0dbd-7f5f-4653-93db-15db4d033001"; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	818	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	560	3196	hv-cinder-83998	S-1-5-18	4/29/2022 6:58:25 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {A3FC14EC-0F51-421B-A009-200AA15F021F}; ClientMachine = HV-CINDER-83998; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4608; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_IDMethod.HostName="iqn.2010-10.org.openstack:volume-6cee0dbd-7f5f-4653-93db-15db4d033001",Method=4,Value="iqn.1991-05.com.microsoft:hv-cinder-83998"; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	817	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	560	2520	hv-cinder-83998	S-1-5-18	4/29/2022 6:58:25 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {B842A36F-43E6-4157-A43C-180531DBBE36}; ClientMachine = HV-CINDER-83998; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4608; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Host.HostName="iqn.2010-10.org.openstack:volume-b825cbf1-f967-48f5-a558-be4431f95d5e"; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	816	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	560	4248	hv-cinder-83998	S-1-5-18	4/29/2022 6:58:20 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {E73F9209-2436-4AB1-8D86-74DE781AABE4}; ClientMachine = HV-CINDER-83998; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4608; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_IDMethod.HostName="iqn.2010-10.org.openstack:volume-b825cbf1-f967-48f5-a558-be4431f95d5e",Method=4,Value="iqn.1991-05.com.microsoft:hv-cinder-83998"; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	815	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	560	4872	hv-cinder-83998	S-1-5-18	4/29/2022 6:58:19 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {701E26D8-6E51-4D59-AFFB-DA6DE80475E5}; ClientMachine = HV-CINDER-83998; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4608; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{E9638BA3-8D3E-484C-85E1-4A57F2554849}"; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	814	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	560	4872	hv-cinder-83998	S-1-5-18	4/29/2022 6:58:18 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {22D5182A-6DCD-4255-9A58-2D160DDCB598}; ClientMachine = HV-CINDER-83998; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4608; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=327197516; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	813	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	560	4248	hv-cinder-83998	S-1-5-18	4/29/2022 6:58:17 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {8EC86EED-D5A1-4AC9-861F-572601F9B35F}; ClientMachine = HV-CINDER-83998; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4608; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1385131757; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	812	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	560	4872	hv-cinder-83998	S-1-5-18	4/29/2022 6:58:16 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {26295400-77F4-496D-A5D7-4BEC7B447091}; ClientMachine = HV-CINDER-83998; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4608; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Host.HostName="iqn.2010-10.org.openstack:volume-51dbce26-0024-4dd3-a995-a15e539acf51"; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	811	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	560	4872	hv-cinder-83998	S-1-5-18	4/29/2022 6:58:15 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {29FEDE76-8C75-4C4B-BA67-2D798213EAB6}; ClientMachine = HV-CINDER-83998; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4608; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_IDMethod.HostName="iqn.2010-10.org.openstack:volume-51dbce26-0024-4dd3-a995-a15e539acf51",Method=4,Value="iqn.1991-05.com.microsoft:hv-cinder-83998"; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	810	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	560	4872	hv-cinder-83998	S-1-5-18	4/29/2022 6:58:15 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00BE7A26-C0A6-4CEC-9DC5-211D3A40F9F2}; ClientMachine = HV-CINDER-83998; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4608; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1417948956; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	809	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	560	4248	hv-cinder-83998	S-1-5-18	4/29/2022 6:58:13 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
StorageWMI provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1416; ProviderPath = %SystemRoot%\System32\storagewmi.dll	5857	0	4611686018427387904	808	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	1416	5000	hv-cinder-83998	S-1-5-20	4/29/2022 6:58:13 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {E0634ED0-193C-426B-A176-5F616A371D83}; ClientMachine = HV-CINDER-83998; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4608; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=313146070; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	807	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	560	2232	hv-cinder-83998	S-1-5-18	4/29/2022 6:58:12 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {756FE66A-D1F8-4D87-94AB-CB064A7C3A38}; ClientMachine = HV-CINDER-83998; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4608; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1313202030; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	806	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	560	2520	hv-cinder-83998	S-1-5-18	4/29/2022 6:58:11 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {2618638F-ADF7-45AD-922F-26BC77AF3545}; ClientMachine = HV-CINDER-83998; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4608; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=8160865; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	805	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	560	2156	hv-cinder-83998	S-1-5-18	4/29/2022 6:58:10 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {04E07D4A-1299-4BCB-BBB1-D3E9DF4EF38F}; ClientMachine = HV-CINDER-83998; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4608; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1578015732; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	804	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	560	2520	hv-cinder-83998	S-1-5-18	4/29/2022 6:58:07 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {6688E3C1-615C-49B9-B77B-BA9161FA44BD}; ClientMachine = HV-CINDER-83998; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4608; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=667034076; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	803	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	560	2232	hv-cinder-83998	S-1-5-18	4/29/2022 6:58:04 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {2278402B-209A-4B7F-B958-43E19DDF3062}; ClientMachine = HV-CINDER-83998; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4608; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=511912708; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	802	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	560	2520	hv-cinder-83998	S-1-5-18	4/29/2022 6:58:01 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {C2D44F67-74A6-4BC5-9232-6DAFC135E192}; ClientMachine = HV-CINDER-83998; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4608; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1280966270; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	801	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	560	2232	hv-cinder-83998	S-1-5-18	4/29/2022 6:58:01 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {7A4CC7C8-E67A-47A8-8AA0-1D2C4FD8BB72}; ClientMachine = HV-CINDER-83998; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4608; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{DBC4AC6B-E7E6-4AD7-84B7-7F64B47D4CB1}"; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	800	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	560	2232	hv-cinder-83998	S-1-5-18	4/29/2022 6:58:00 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {DB8E9AC6-80C5-4DC5-B3E5-03753DB1DC20}; ClientMachine = HV-CINDER-83998; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4608; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=2045840500; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	799	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	560	2232	hv-cinder-83998	S-1-5-18	4/29/2022 6:57:57 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {BA72B59E-2470-457A-B87C-5E1ABA080003}; ClientMachine = HV-CINDER-83998; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4608; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1831791169; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	798	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	560	2520	hv-cinder-83998	S-1-5-18	4/29/2022 6:57:46 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {55794A3C-78BC-4289-97BC-5CE45C057B0A}; ClientMachine = HV-CINDER-83998; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4608; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1787179363; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	797	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	560	2156	hv-cinder-83998	S-1-5-18	4/29/2022 6:57:42 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {37BDE1AF-998E-4B9E-8106-0B19C77130A4}; ClientMachine = HV-CINDER-83998; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4608; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1798404809; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	796	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	560	2156	hv-cinder-83998	S-1-5-18	4/29/2022 6:57:41 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {B1E3F4BE-8AAA-436C-8769-EAA1B8BEAFB6}; ClientMachine = HV-CINDER-83998; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4608; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=635802872; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	795	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	560	4872	hv-cinder-83998	S-1-5-18	4/29/2022 6:57:24 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {4A04F612-3DF8-4689-94DF-11316EDF8766}; ClientMachine = HV-CINDER-83998; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4608; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=64542751; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	794	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	560	2520	hv-cinder-83998	S-1-5-18	4/29/2022 6:57:24 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FE2A123D-9856-4615-A01C-0DEBA524024C}; ClientMachine = HV-CINDER-83998; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4608; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1203871079; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	793	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	560	4248	hv-cinder-83998	S-1-5-18	4/29/2022 6:57:13 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {23146913-0326-412A-84F3-6A6407868014}; ClientMachine = HV-CINDER-83998; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4608; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1568693322; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	792	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	560	2520	hv-cinder-83998	S-1-5-18	4/29/2022 6:57:01 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {496E3208-365B-4119-9FD0-4B1AE231ABBE}; ClientMachine = HV-CINDER-83998; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4608; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=467631192; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	791	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	560	4248	hv-cinder-83998	S-1-5-18	4/29/2022 6:57:00 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {77D45C2C-E53B-4CD4-86EE-639D83BB9EF1}; ClientMachine = HV-CINDER-83998; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4608; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1484773063; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	790	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	560	2156	hv-cinder-83998	S-1-5-18	4/29/2022 6:56:47 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {73D899C3-F82A-48D5-9911-BCC88F7BC3AE}; ClientMachine = HV-CINDER-83998; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4608; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=321243330; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	789	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	560	2156	hv-cinder-83998	S-1-5-18	4/29/2022 6:56:44 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {275A6651-E15B-4949-9577-640EC975614A}; ClientMachine = HV-CINDER-83998; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4608; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=248350379; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	788	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	560	4872	hv-cinder-83998	S-1-5-18	4/29/2022 6:56:38 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {83C7A3BB-4248-4726-A952-FB6581C57F7D}; ClientMachine = HV-CINDER-83998; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4608; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=776951843; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	787	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	560	2156	hv-cinder-83998	S-1-5-18	4/29/2022 6:56:37 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {CFFAF613-557B-489D-8801-7EAD4EF26CFB}; ClientMachine = HV-CINDER-83998; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4608; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{F8E6933E-7DFE-44AA-A1A5-E67C0E1756A2}"; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	786	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	560	4872	hv-cinder-83998	S-1-5-18	4/29/2022 6:56:37 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {583EB904-BFDA-4BE7-A8B1-D273DDB3A666}; ClientMachine = HV-CINDER-83998; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4608; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=2025207336; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	785	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	560	2156	hv-cinder-83998	S-1-5-18	4/29/2022 6:56:36 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {E8269A03-DE07-41E7-B39D-34085715D1CD}; ClientMachine = HV-CINDER-83998; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4608; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1920644036; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	784	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	560	2156	hv-cinder-83998	S-1-5-18	4/29/2022 6:56:26 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FAE2C000-27EF-45FE-84F8-574EFE4AB6D4}; ClientMachine = HV-CINDER-83998; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4608; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{6D8CD77B-1017-4124-B880-FE7B12342394}"; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	783	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	560	2888	hv-cinder-83998	S-1-5-18	4/29/2022 6:56:26 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {D0829120-F8A3-486A-9F1E-021E17F70769}; ClientMachine = HV-CINDER-83998; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4608; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{F45E4E47-1696-4618-877C-8B818058B8A3}"; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	782	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	560	2888	hv-cinder-83998	S-1-5-18	4/29/2022 6:56:25 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {BDF42AE1-C9D2-48AE-9C59-8DBA5C8DC780}; ClientMachine = HV-CINDER-83998; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4608; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=856329694; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	781	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	560	2888	hv-cinder-83998	S-1-5-18	4/29/2022 6:56:06 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {EFB2E996-C2D7-4EE9-88D6-05B93C4D887B}; ClientMachine = HV-CINDER-83998; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4608; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1493992380; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	780	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	560	4872	hv-cinder-83998	S-1-5-18	4/29/2022 6:56:05 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {6F9F1548-E243-4931-9D77-63F0BDDFE6A3}; ClientMachine = HV-CINDER-83998; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4608; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=579465508; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	779	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	560	2888	hv-cinder-83998	S-1-5-18	4/29/2022 6:56:04 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {D3424C07-9841-47C1-9F30-724F908CBA6E}; ClientMachine = HV-CINDER-83998; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4608; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=588093344; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	778	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	560	2156	hv-cinder-83998	S-1-5-18	4/29/2022 6:56:04 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {05C26AE9-9DD4-4C60-B32B-023247B18DB7}; ClientMachine = HV-CINDER-83998; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4608; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=677435618; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	777	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	560	2888	hv-cinder-83998	S-1-5-18	4/29/2022 6:55:47 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9543812F-20A5-4E24-96CC-68863B275002}; ClientMachine = HV-CINDER-83998; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4608; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1071096342; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	776	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	560	4872	hv-cinder-83998	S-1-5-18	4/29/2022 6:55:46 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {2B73A451-0FF7-483A-A09C-45C06E280AC9}; ClientMachine = HV-CINDER-83998; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4608; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1083645923; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	775	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	560	2888	hv-cinder-83998	S-1-5-18	4/29/2022 6:55:44 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {57E23A78-6AF8-4900-B034-7C5F808D0380}; ClientMachine = HV-CINDER-83998; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4608; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Host.HostName="iqn.2010-10.org.openstack:volume-aaaf2888-ffa8-4274-94db-a75c278145dc"; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	774	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	560	2888	hv-cinder-83998	S-1-5-18	4/29/2022 6:55:36 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {4C65865E-3422-475D-A54C-9A115BD4A21B}; ClientMachine = HV-CINDER-83998; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4608; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_IDMethod.HostName="iqn.2010-10.org.openstack:volume-aaaf2888-ffa8-4274-94db-a75c278145dc",Method=4,Value="iqn.1991-05.com.microsoft:hv-cinder-83998"; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	773	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	560	2888	hv-cinder-83998	S-1-5-18	4/29/2022 6:55:35 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {57C162FA-AE7A-448A-9398-6355E6E85B72}; ClientMachine = HV-CINDER-83998; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4608; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Host.HostName="iqn.2010-10.org.openstack:volume-1847e422-6197-400c-95ca-f36b52ec7904"; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	772	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	560	2156	hv-cinder-83998	S-1-5-18	4/29/2022 6:55:32 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {4D91BB52-11AB-4252-A303-BD65079BC3AD}; ClientMachine = HV-CINDER-83998; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4608; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_IDMethod.HostName="iqn.2010-10.org.openstack:volume-1847e422-6197-400c-95ca-f36b52ec7904",Method=4,Value="iqn.1991-05.com.microsoft:hv-cinder-83998"; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	771	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	560	2888	hv-cinder-83998	S-1-5-18	4/29/2022 6:55:31 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
StorageWMI provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1416; ProviderPath = %SystemRoot%\System32\storagewmi.dll	5857	0	4611686018427387904	770	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	1416	872	hv-cinder-83998	S-1-5-20	4/29/2022 6:55:10 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
MSVSS__PROVIDER provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1416; ProviderPath = %systemroot%\system32\wbem\vsswmi.dll	5857	0	4611686018427387904	769	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	1416	872	hv-cinder-83998	S-1-5-20	4/29/2022 6:55:06 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {91E8018E-23DA-4AB3-B3A2-9442B2AFDA3E}; ClientMachine = HV-CINDER-83998; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4608; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1169411081; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	768	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	560	2520	hv-cinder-83998	S-1-5-18	4/29/2022 6:55:04 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {A4C54734-1E34-4174-86F3-65DEF0ED8F49}; ClientMachine = HV-CINDER-83998; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4608; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=23565190; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	767	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	560	2520	hv-cinder-83998	S-1-5-18	4/29/2022 6:53:58 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {EE0A980E-7076-4A47-A043-4CEFFA76EF2C}; ClientMachine = HV-CINDER-83998; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4608; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Host.HostName="iqn.2010-10.org.openstack:volume-178cbe22-6f55-4c28-8f6c-4a5c430172ea"; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	766	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	560	2520	hv-cinder-83998	S-1-5-18	4/29/2022 6:53:58 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {8743E271-42EE-4370-A877-97D4160F7E6F}; ClientMachine = HV-CINDER-83998; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4608; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_IDMethod.HostName="iqn.2010-10.org.openstack:volume-178cbe22-6f55-4c28-8f6c-4a5c430172ea",Method=4,Value="iqn.1991-05.com.microsoft:hv-cinder-83998"; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	765	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	560	2520	hv-cinder-83998	S-1-5-18	4/29/2022 6:53:57 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
StorageWMI provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1416; ProviderPath = %SystemRoot%\System32\storagewmi.dll	5857	0	4611686018427387904	764	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	1416	872	hv-cinder-83998	S-1-5-20	4/29/2022 6:53:56 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
MSVSS__PROVIDER provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1416; ProviderPath = %systemroot%\system32\wbem\vsswmi.dll	5857	0	4611686018427387904	763	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	1416	872	hv-cinder-83998	S-1-5-20	4/29/2022 6:53:54 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WinTargetProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4680; ProviderPath = C:\windows\system32\wbem\WTWMIProv.dll	5857	0	4611686018427387904	762	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	4680	584	hv-cinder-83998	S-1-5-19	4/29/2022 6:53:53 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {33E89606-DA24-4D26-9FDB-60CA9449B1C1}; ClientMachine = HV-CINDER-83998; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4608; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1394628682; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	761	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	560	2520	hv-cinder-83998	S-1-5-18	4/29/2022 6:53:04 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {7EEE23FF-4ADA-434D-BE91-AF0620547E35}; ClientMachine = HV-CINDER-83998; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4608; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=71264534; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	760	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	560	2232	hv-cinder-83998	S-1-5-18	4/29/2022 6:53:03 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {BABC4A90-D616-4422-A223-F6A57C68B6F6}; ClientMachine = HV-CINDER-83998; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4608; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1590348239; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	759	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	560	2232	hv-cinder-83998	S-1-5-18	4/29/2022 6:53:01 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {869893B6-F148-4E71-B587-4C7403C75788}; ClientMachine = HV-CINDER-83998; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4608; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Host.HostName="iqn.2010-10.org.openstack:volume-8f1067cd-412c-473e-ad51-1c5740d5e549"; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	758	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	560	2520	hv-cinder-83998	S-1-5-18	4/29/2022 6:53:00 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {336117AC-0A91-4275-AACD-D010BBE77E9A}; ClientMachine = HV-CINDER-83998; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4608; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_IDMethod.HostName="iqn.2010-10.org.openstack:volume-8f1067cd-412c-473e-ad51-1c5740d5e549",Method=4,Value="iqn.1991-05.com.microsoft:hv-cinder-83998"; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	757	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	560	2156	hv-cinder-83998	S-1-5-18	4/29/2022 6:53:00 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {E488DC29-F86D-4A74-9A55-146652CE1F90}; ClientMachine = HV-CINDER-83998; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4608; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Host.HostName="iqn.2010-10.org.openstack:volume-66300dbe-26b5-45bd-bdd6-09a85e41d968"; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	756	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	560	2232	hv-cinder-83998	S-1-5-18	4/29/2022 6:52:54 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {4787539A-F5C9-4805-8CFF-A86788DEF171}; ClientMachine = HV-CINDER-83998; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4608; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_IDMethod.HostName="iqn.2010-10.org.openstack:volume-66300dbe-26b5-45bd-bdd6-09a85e41d968",Method=4,Value="iqn.1991-05.com.microsoft:hv-cinder-83998"; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	755	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	560	2232	hv-cinder-83998	S-1-5-18	4/29/2022 6:52:54 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WinTargetProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4680; ProviderPath = C:\windows\system32\wbem\WTWMIProv.dll	5857	0	4611686018427387904	754	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	4680	584	hv-cinder-83998	S-1-5-19	4/29/2022 6:52:54 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {19A5DFDC-FEA9-4F86-B168-CD85B7C8ADAA}; ClientMachine = HV-CINDER-83998; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4608; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Host.HostName="iqn.2010-10.org.openstack:volume-6cee0dbd-7f5f-4653-93db-15db4d033001"; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	753	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	560	2888	hv-cinder-83998	S-1-5-18	4/29/2022 6:52:05 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {AEF21F79-9F02-4AC3-ADFC-133DDE1E1338}; ClientMachine = HV-CINDER-83998; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4608; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_IDMethod.HostName="iqn.2010-10.org.openstack:volume-6cee0dbd-7f5f-4653-93db-15db4d033001",Method=4,Value="iqn.1991-05.com.microsoft:hv-cinder-83998"; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	752	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	560	2232	hv-cinder-83998	S-1-5-18	4/29/2022 6:52:05 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {405E95F8-ACB5-4C10-ABF1-F14E256FD9C1}; ClientMachine = HV-CINDER-83998; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4608; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Host.HostName="iqn.2010-10.org.openstack:volume-45e92c86-8659-48c4-ab31-3f0865d23a57"; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	751	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	560	2232	hv-cinder-83998	S-1-5-18	4/29/2022 6:51:38 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {1BF66E34-038D-467F-876E-1B41DE2018BD}; ClientMachine = HV-CINDER-83998; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4608; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_IDMethod.HostName="iqn.2010-10.org.openstack:volume-45e92c86-8659-48c4-ab31-3f0865d23a57",Method=4,Value="iqn.1991-05.com.microsoft:hv-cinder-83998"; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	750	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	560	4964	hv-cinder-83998	S-1-5-18	4/29/2022 6:51:38 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {91BFF47C-7382-41BF-8221-48558CBE523D}; ClientMachine = HV-CINDER-83998; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4608; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Host.HostName="iqn.2010-10.org.openstack:volume-178cbe22-6f55-4c28-8f6c-4a5c430172ea"; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	749	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	560	4964	hv-cinder-83998	S-1-5-18	4/29/2022 6:51:34 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {B420B75E-45C8-4A03-BED5-817E39EA20F3}; ClientMachine = HV-CINDER-83998; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4608; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_IDMethod.HostName="iqn.2010-10.org.openstack:volume-178cbe22-6f55-4c28-8f6c-4a5c430172ea",Method=4,Value="iqn.1991-05.com.microsoft:hv-cinder-83998"; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	748	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	560	4964	hv-cinder-83998	S-1-5-18	4/29/2022 6:51:34 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1416; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll	5857	0	4611686018427387904	747	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	1416	872	hv-cinder-83998	S-1-5-20	4/29/2022 6:51:20 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {5F750C48-02E9-4693-928E-F98C2260A748}; ClientMachine = HV-CINDER-83998; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4608; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Host.HostName="iqn.2010-10.org.openstack:volume-91d98404-9dcc-41ea-bbde-988646983ce1"; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	746	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	560	2156	hv-cinder-83998	S-1-5-18	4/29/2022 6:50:52 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {542786D8-56C1-4C3A-8290-A88219159689}; ClientMachine = HV-CINDER-83998; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4608; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_IDMethod.HostName="iqn.2010-10.org.openstack:volume-91d98404-9dcc-41ea-bbde-988646983ce1",Method=4,Value="iqn.1991-05.com.microsoft:hv-cinder-83998"; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	745	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	560	2156	hv-cinder-83998	S-1-5-18	4/29/2022 6:50:52 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
StorageWMI provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1416; ProviderPath = %SystemRoot%\System32\storagewmi.dll	5857	0	4611686018427387904	744	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	1416	872	hv-cinder-83998	S-1-5-20	4/29/2022 6:50:44 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {3185BF2C-9F73-4DD3-B607-CD24F6B28685}; ClientMachine = HV-CINDER-83998; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4608; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1288156459; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	743	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	560	4872	hv-cinder-83998	S-1-5-18	4/29/2022 6:50:21 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {6B291DEF-9E6F-4E2C-903D-F9F6C0106142}; ClientMachine = HV-CINDER-83998; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4608; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1380888146; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	742	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	560	4964	hv-cinder-83998	S-1-5-18	4/29/2022 6:50:20 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {2B85605E-790B-4FFF-8641-36DEAD1B7078}; ClientMachine = HV-CINDER-83998; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4608; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1031260336; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	741	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	560	4964	hv-cinder-83998	S-1-5-18	4/29/2022 6:50:19 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {58A56F71-332B-43D3-B91C-5543032B14DB}; ClientMachine = HV-CINDER-83998; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4608; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{84217790-C23B-491E-9B0A-11298258F061}"; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	740	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	560	2156	hv-cinder-83998	S-1-5-18	4/29/2022 6:50:18 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {B7275D4F-B30E-4147-B525-F30FF7D71105}; ClientMachine = HV-CINDER-83998; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4608; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1474686656; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	739	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	560	4964	hv-cinder-83998	S-1-5-18	4/29/2022 6:50:17 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {2554BE6E-1662-4AF0-8036-33A00152D9CE}; ClientMachine = HV-CINDER-83998; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4608; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{3CFF25A9-446B-4CCE-94BF-CC0D814625EB}"; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	738	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	560	4872	hv-cinder-83998	S-1-5-18	4/29/2022 6:50:15 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FC97ECC2-337B-4545-AB1F-FA6E86A72F61}; ClientMachine = HV-CINDER-83998; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4608; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=661196192; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	737	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	560	4964	hv-cinder-83998	S-1-5-18	4/29/2022 6:50:14 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {E121D04D-C9CB-496C-AA53-580E4CEA1338}; ClientMachine = HV-CINDER-83998; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4608; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=96006571; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	736	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	560	4872	hv-cinder-83998	S-1-5-18	4/29/2022 6:50:13 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {0AA4E147-C8D0-45E5-B313-0A73FF163E0B}; ClientMachine = HV-CINDER-83998; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4608; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1273814851; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	735	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	560	4872	hv-cinder-83998	S-1-5-18	4/29/2022 6:50:03 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9D0CCE1E-8D51-434F-BE0D-1905BC4D21D9}; ClientMachine = HV-CINDER-83998; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4608; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1312267351; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	734	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	560	2520	hv-cinder-83998	S-1-5-18	4/29/2022 6:50:02 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
MSVSS__PROVIDER provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1416; ProviderPath = %systemroot%\system32\wbem\vsswmi.dll	5857	0	4611686018427387904	733	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	1416	872	hv-cinder-83998	S-1-5-20	4/29/2022 6:49:55 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {F0E702CA-2A95-4EA9-9272-A21C88B267FC}; ClientMachine = HV-CINDER-83998; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4608; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Host.HostName="iqn.2010-10.org.openstack:volume-ee7ee386-7afc-446c-8ee9-8e1f8b8b3d6a"; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	732	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	560	4872	hv-cinder-83998	S-1-5-18	4/29/2022 6:49:45 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {878C0F0F-8351-40E9-B9F1-69C234424488}; ClientMachine = HV-CINDER-83998; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4608; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_IDMethod.HostName="iqn.2010-10.org.openstack:volume-ee7ee386-7afc-446c-8ee9-8e1f8b8b3d6a",Method=4,Value="iqn.1991-05.com.microsoft:hv-cinder-83998"; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	731	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	560	4872	hv-cinder-83998	S-1-5-18	4/29/2022 6:49:45 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {1916CBB7-6763-49AD-B03B-22294968A306}; ClientMachine = HV-CINDER-83998; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4608; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{1B3B8C7B-7BFD-4652-A7E1-EA5F1E59063D}"; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	730	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	560	4964	hv-cinder-83998	S-1-5-18	4/29/2022 6:49:31 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {055E4F7D-7B1F-4B1F-87D9-F1CEE4DAD219}; ClientMachine = HV-CINDER-83998; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4608; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{79D4AB24-A9BE-44AC-BC2B-059FF0D4E101}"; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	729	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	560	2520	hv-cinder-83998	S-1-5-18	4/29/2022 6:49:30 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {59C81F82-0535-46A1-B86D-F9A32A8C7C7D}; ClientMachine = HV-CINDER-83998; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4608; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{EB8946FA-3D22-44D6-9C43-B3EEEDA9BCEC}"; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	728	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	560	4964	hv-cinder-83998	S-1-5-18	4/29/2022 6:49:29 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {1AF01980-F346-41A0-B233-A136ED79386F}; ClientMachine = HV-CINDER-83998; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4608; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{127E5876-666C-457F-8FE3-1965B34A1D78}"; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	727	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	560	2156	hv-cinder-83998	S-1-5-18	4/29/2022 6:48:25 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {254E89E0-BE7A-4FF5-ACEF-FFF33AF584EB}; ClientMachine = HV-CINDER-83998; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4608; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Host.HostName="iqn.2010-10.org.openstack:volume-36f290e0-ab78-49a2-84e9-9727252b1ab1"; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	726	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	560	2888	hv-cinder-83998	S-1-5-18	4/29/2022 6:47:44 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FCA1F964-275B-47F7-A578-BC5A8E1211AD}; ClientMachine = HV-CINDER-83998; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4608; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_IDMethod.HostName="iqn.2010-10.org.openstack:volume-36f290e0-ab78-49a2-84e9-9727252b1ab1",Method=4,Value="iqn.1991-05.com.microsoft:hv-cinder-83998"; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	725	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	560	4208	hv-cinder-83998	S-1-5-18	4/29/2022 6:47:44 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {31D449EE-5C35-48E1-8299-4507432DCBD9}; ClientMachine = HV-CINDER-83998; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4608; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{DBDA2FDB-20A3-4BC8-A6CE-70BC3BEC4B3B}"; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	724	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	560	4208	hv-cinder-83998	S-1-5-18	4/29/2022 6:47:33 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {A82C232D-0590-4C54-A484-FB874239C53C}; ClientMachine = HV-CINDER-83998; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4608; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{F3F7827C-EFE0-4ECC-B1AA-A0C3819774C0}"; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	723	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	560	3016	hv-cinder-83998	S-1-5-18	4/29/2022 6:47:32 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {7D636BA6-202E-4B2E-A377-CF4980C13846}; ClientMachine = HV-CINDER-83998; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4608; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{B838BC8E-75EA-47E4-9AAB-AAF7AE26F6B1}"; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	722	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	560	3016	hv-cinder-83998	S-1-5-18	4/29/2022 6:47:31 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9BF77887-610F-4F53-BB14-FF0C4386F7EA}; ClientMachine = HV-CINDER-83998; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4608; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=227525030; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	721	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	560	3016	hv-cinder-83998	S-1-5-18	4/29/2022 6:47:09 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {15E29212-ED7F-4F9A-A48C-7A5C4C69C9E7}; ClientMachine = HV-CINDER-83998; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4608; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{2A20C148-FFD4-4DE1-9295-26B70A38E16C}"; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	720	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	560	3076	hv-cinder-83998	S-1-5-18	4/29/2022 6:47:07 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00843406-010A-4E36-AA3D-38CA4282F1C2}; ClientMachine = HV-CINDER-83998; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4608; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1281507520; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	719	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	560	2888	hv-cinder-83998	S-1-5-18	4/29/2022 6:46:54 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
StorageWMI provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1416; ProviderPath = %SystemRoot%\System32\storagewmi.dll	5857	0	4611686018427387904	718	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	1416	872	hv-cinder-83998	S-1-5-20	4/29/2022 6:46:54 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {4212A648-CB74-4006-B37B-1E03CACAF98B}; ClientMachine = HV-CINDER-83998; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4608; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=57246930; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	717	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	560	3076	hv-cinder-83998	S-1-5-18	4/29/2022 6:46:10 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {67E74CAF-93C1-4406-9C87-891718BB7285}; ClientMachine = HV-CINDER-83998; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4608; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1378119311; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	716	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	560	3076	hv-cinder-83998	S-1-5-18	4/29/2022 6:46:09 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {F1287726-3A0C-48DE-9E3C-B7A22303919D}; ClientMachine = HV-CINDER-83998; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4608; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=250572345; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	715	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	560	3076	hv-cinder-83998	S-1-5-18	4/29/2022 6:46:09 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {7E8D6EE9-2956-4A40-9D1E-F4CA2FDF2D28}; ClientMachine = HV-CINDER-83998; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4608; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=106817847; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	714	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	560	4248	hv-cinder-83998	S-1-5-18	4/29/2022 6:46:07 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {D324274F-A2E1-4A12-86D7-6B3DD28B8B00}; ClientMachine = HV-CINDER-83998; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4608; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1827264332; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	713	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	560	4248	hv-cinder-83998	S-1-5-18	4/29/2022 6:46:00 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {2BC8B9D7-9011-408C-A18E-51D17EFC316B}; ClientMachine = HV-CINDER-83998; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4608; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=490660975; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	712	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	560	4248	hv-cinder-83998	S-1-5-18	4/29/2022 6:45:54 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {DA9E64E7-239E-4505-AE75-0231984BF734}; ClientMachine = HV-CINDER-83998; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4608; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1947792661; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	711	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	560	4248	hv-cinder-83998	S-1-5-18	4/29/2022 6:45:51 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {ABE07251-1402-43AA-9F07-34A31ED2DF1A}; ClientMachine = HV-CINDER-83998; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4608; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Host.HostName="iqn.2010-10.org.openstack:volume-1ea3f90e-f079-4096-b3f4-5551fc5dcede"; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	710	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	560	2376	hv-cinder-83998	S-1-5-18	4/29/2022 6:45:48 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {CFEFCE99-A54A-4A9C-A85C-A1C419445893}; ClientMachine = HV-CINDER-83998; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4608; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_IDMethod.HostName="iqn.2010-10.org.openstack:volume-1ea3f90e-f079-4096-b3f4-5551fc5dcede",Method=4,Value="iqn.1991-05.com.microsoft:hv-cinder-83998"; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	709	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	560	2376	hv-cinder-83998	S-1-5-18	4/29/2022 6:45:48 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {5FD03B67-7975-4310-99AF-C184CAE0ED10}; ClientMachine = HV-CINDER-83998; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4608; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1353360765; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	708	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	560	4248	hv-cinder-83998	S-1-5-18	4/29/2022 6:45:42 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {EDEE7C1B-BFF2-4E90-8147-8428F5168781}; ClientMachine = HV-CINDER-83998; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4608; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=899725709; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	707	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	560	4872	hv-cinder-83998	S-1-5-18	4/29/2022 6:45:41 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {B086DF92-116D-4391-81D8-86C02F641DAE}; ClientMachine = HV-CINDER-83998; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4608; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=692778278; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	706	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	560	4872	hv-cinder-83998	S-1-5-18	4/29/2022 6:45:40 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {C9CC5D66-6EB8-499B-8CA0-CAEC01587B0A}; ClientMachine = HV-CINDER-83998; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4608; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{DBD3E19D-8A16-4521-9266-28E2C5316B64}"; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	705	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	560	4872	hv-cinder-83998	S-1-5-18	4/29/2022 6:45:40 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {F76B1837-8B84-4BAB-8A82-D165154E73E7}; ClientMachine = HV-CINDER-83998; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4608; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{4FDEDCFF-D285-4EB6-A935-037AFED7E669}"; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	704	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	560	3196	hv-cinder-83998	S-1-5-18	4/29/2022 6:45:38 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {6AC89C05-CD7F-46FB-9EEB-19FDFD3C36C5}; ClientMachine = HV-CINDER-83998; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4608; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1085301503; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	703	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	560	4752	hv-cinder-83998	S-1-5-18	4/29/2022 6:45:24 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {2EE98761-06BC-4CA3-9DEC-075ECDB608EB}; ClientMachine = HV-CINDER-83998; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4608; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1570157727; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	702	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	560	4752	hv-cinder-83998	S-1-5-18	4/29/2022 6:45:16 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {6A667D84-D23C-42C2-8AFB-DF403975FE4F}; ClientMachine = HV-CINDER-83998; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4608; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{A8CD2E96-190A-4EB0-A75F-525EC88312CA}"; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	701	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	560	4872	hv-cinder-83998	S-1-5-18	4/29/2022 6:45:12 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {54C34F4B-1ABC-435E-BDE8-5E35E57663C5}; ClientMachine = HV-CINDER-83998; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4608; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1301345474; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	700	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	560	4752	hv-cinder-83998	S-1-5-18	4/29/2022 6:45:11 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
StorageWMI provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1416; ProviderPath = %SystemRoot%\System32\storagewmi.dll	5857	0	4611686018427387904	699	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	1416	872	hv-cinder-83998	S-1-5-20	4/29/2022 6:45:11 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {4586D04D-BB7A-445E-89BB-FFB068FA7DDC}; ClientMachine = HV-CINDER-83998; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4608; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1816188634; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	698	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	560	4752	hv-cinder-83998	S-1-5-18	4/29/2022 6:45:11 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {7A8E935D-1089-4B45-B3DD-83C8EFD72CA3}; ClientMachine = HV-CINDER-83998; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4608; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{776AA16C-E86D-4C60-9018-1D147935DE7E}"; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	697	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	560	4872	hv-cinder-83998	S-1-5-18	4/29/2022 6:45:03 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9FE52B9B-C23B-47D3-A8DF-F0B86EFA2D9A}; ClientMachine = HV-CINDER-83998; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4608; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{FB0E12AE-67DF-4DF3-B603-3DE42448967E}"; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	696	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	560	2156	hv-cinder-83998	S-1-5-18	4/29/2022 6:45:01 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {5F8777A9-54AA-4543-8F2A-0FBF9580FE4C}; ClientMachine = HV-CINDER-83998; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4608; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=2037847000; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	695	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	560	3196	hv-cinder-83998	S-1-5-18	4/29/2022 6:45:01 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {40DF7FBC-D676-49F6-9C2E-48CE5A018BC8}; ClientMachine = HV-CINDER-83998; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4608; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1100097396; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	694	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	560	4872	hv-cinder-83998	S-1-5-18	4/29/2022 6:45:00 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9947FD9F-48B1-4410-91F4-A0785BE2CF09}; ClientMachine = HV-CINDER-83998; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4608; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{5E245106-F944-4F3B-9D50-EB575D8263FF}"; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	693	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	560	3076	hv-cinder-83998	S-1-5-18	4/29/2022 6:44:50 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {322879E6-BD5E-47F5-B912-90D202352526}; ClientMachine = HV-CINDER-83998; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4608; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1066596818; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	692	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	560	2156	hv-cinder-83998	S-1-5-18	4/29/2022 6:44:50 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {EE0AF7DD-092B-4FAB-A7D2-2B0A1F5CE3E4}; ClientMachine = HV-CINDER-83998; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4608; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1859140041; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	691	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	560	3196	hv-cinder-83998	S-1-5-18	4/29/2022 6:44:41 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {AFF88897-7159-4F35-8DAD-495B63A028AF}; ClientMachine = HV-CINDER-83998; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4608; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{BCBC143A-2F7F-4E3B-8936-7F8E9D8609E5}"; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	690	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	560	3196	hv-cinder-83998	S-1-5-18	4/29/2022 6:44:41 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {ED82E132-D389-4037-8176-C30996DEC80F}; ClientMachine = HV-CINDER-83998; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4608; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{6FB41CD5-3622-4AC2-A1E1-D80913AB4E0C}"; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	689	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	560	2156	hv-cinder-83998	S-1-5-18	4/29/2022 6:44:40 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {E5883248-0695-4143-B071-E9E512E62C4F}; ClientMachine = HV-CINDER-83998; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4608; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{DEAD77B6-6004-457B-9B11-61F47792D1F3}"; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	688	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	560	4208	hv-cinder-83998	S-1-5-18	4/29/2022 6:44:27 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {87A54C04-EFBD-4C79-AA30-2274D4AE21DA}; ClientMachine = HV-CINDER-83998; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4608; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=503330407; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	687	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	560	3016	hv-cinder-83998	S-1-5-18	4/29/2022 6:44:26 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {4492CBB3-CEEE-4103-8B03-902E58F79BA6}; ClientMachine = HV-CINDER-83998; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4608; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1432050392; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	686	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	560	2376	hv-cinder-83998	S-1-5-18	4/29/2022 6:44:20 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {7914850D-B575-4954-A809-60ECA588B853}; ClientMachine = HV-CINDER-83998; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4608; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=2118833311; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	685	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	560	2376	hv-cinder-83998	S-1-5-18	4/29/2022 6:44:20 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {C523BD4A-8287-4D46-AEE5-7ED97C0071E3}; ClientMachine = HV-CINDER-83998; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4608; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{EC081C01-D893-497B-901A-A2FC333B976F}"; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	684	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	560	2156	hv-cinder-83998	S-1-5-18	4/29/2022 6:44:15 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {DA8E871F-3072-4EDF-9FEF-B8FE3C200BAE}; ClientMachine = HV-CINDER-83998; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4608; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{0E956335-154E-4372-B31E-A170DC952155}"; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	683	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	560	4752	hv-cinder-83998	S-1-5-18	4/29/2022 6:44:14 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {C5700E95-7F4A-47E9-AA65-9C6666CAC23F}; ClientMachine = HV-CINDER-83998; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4608; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=683509481; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	682	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	560	4752	hv-cinder-83998	S-1-5-18	4/29/2022 6:44:14 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {886CF858-45F8-4E15-9833-E24DC3BFD573}; ClientMachine = HV-CINDER-83998; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4608; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=317037943; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	681	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	560	2156	hv-cinder-83998	S-1-5-18	4/29/2022 6:43:59 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {771E43AA-2C29-4CA1-8597-815E0804B265}; ClientMachine = HV-CINDER-83998; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4608; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=2134375466; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	680	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	560	2156	hv-cinder-83998	S-1-5-18	4/29/2022 6:43:59 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {1F81CE4C-D2CF-42D0-88D7-09FAD4365014}; ClientMachine = HV-CINDER-83998; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4608; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1087727793; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	679	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	560	2376	hv-cinder-83998	S-1-5-18	4/29/2022 6:43:59 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {4B1031D5-5E3F-42A8-8CED-0D4EF2761626}; ClientMachine = HV-CINDER-83998; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4608; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{B035E073-2D05-4B72-B55E-E0FB8D595F01}"; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	678	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	560	2376	hv-cinder-83998	S-1-5-18	4/29/2022 6:43:58 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {65AD2D17-E18A-4486-8991-C7A95216A310}; ClientMachine = HV-CINDER-83998; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4608; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=173744671; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	677	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	560	3016	hv-cinder-83998	S-1-5-18	4/29/2022 6:43:51 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {1CC56E28-4633-48AF-BC1A-D6AEF1AF3C2C}; ClientMachine = HV-CINDER-83998; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4608; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1964459574; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	676	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	560	2520	hv-cinder-83998	S-1-5-18	4/29/2022 6:43:51 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {E0BF50BA-20BB-4440-B8AC-DDBC287955ED}; ClientMachine = HV-CINDER-83998; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4608; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{7F708C6A-75AB-4851-BD29-4FBE7DC31432}"; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	675	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	560	4752	hv-cinder-83998	S-1-5-18	4/29/2022 6:43:50 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {1C0FC721-F828-4353-BE62-E01C01BACCFE}; ClientMachine = HV-CINDER-83998; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4608; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{DED49560-9FCA-41D3-A546-414FCEA1FE3F}"; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	674	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	560	4752	hv-cinder-83998	S-1-5-18	4/29/2022 6:43:49 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {22CE6991-0740-40D8-8D08-73DBA0C09AE7}; ClientMachine = HV-CINDER-83998; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4608; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1001932631; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	673	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	560	3016	hv-cinder-83998	S-1-5-18	4/29/2022 6:43:49 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {863C283D-48F5-48B3-B5E6-316455E25762}; ClientMachine = HV-CINDER-83998; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4608; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1341241230; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	672	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	560	2520	hv-cinder-83998	S-1-5-18	4/29/2022 6:43:42 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {DDD94275-1DC7-4C4C-9117-ADCD579BEDE1}; ClientMachine = HV-CINDER-83998; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4608; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=458698658; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	671	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	560	2376	hv-cinder-83998	S-1-5-18	4/29/2022 6:43:25 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {C380F66D-50F7-4CD2-9DE9-743ECF6A8180}; ClientMachine = HV-CINDER-83998; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4608; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1966821780; ResultCode = 0x80041024; PossibleCause = Unknown	5858	2	4611686018427387904	670	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	560	3016	hv-cinder-83998	S-1-5-18	4/29/2022 6:43:24 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
MSVSS__PROVIDER provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1416; ProviderPath = %systemroot%\system32\wbem\vsswmi.dll	5857	0	4611686018427387904	669	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	1416	4364	hv-cinder-83998	S-1-5-20	4/29/2022 6:43:23 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32a provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1416; ProviderPath = %systemroot%\system32\wbem\wmipcima.dll	5857	0	4611686018427387904	668	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	1416	872	hv-cinder-83998	S-1-5-20	4/29/2022 6:43:23 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WinTargetProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4680; ProviderPath = C:\windows\system32\wbem\WTWMIProv.dll	5857	0	4611686018427387904	667	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	4680	584	hv-cinder-83998	S-1-5-19	4/29/2022 6:43:22 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4272; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll	5857	0	4611686018427387904	666	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	4272	4116	hv-cinder-83998	S-1-5-18	4/29/2022 6:41:49 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1416; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll	5857	0	4611686018427387904	665	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	1416	1540	hv-cinder-83998	S-1-5-20	4/29/2022 6:41:49 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WinTargetProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4312; ProviderPath = C:\windows\system32\wbem\WTWMIProv.dll	5857	0	4611686018427387904	664	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	4312	2980	hv-cinder-83998	S-1-5-19	4/29/2022 6:41:24 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Namespace = root\virtualization\v2; NotificationQuery = SELECT * FROM __InstanceDeletionEvent WITHIN 2 WHERE TargetInstance ISA 'Msvm_SyntheticEthernetPortSettingData' ; UserName = NT AUTHORITY\SYSTEM; ClientProcessID = 5068, ClientMachine = HV-CINDER-83998; PossibleCause = Temporary	5860	0	4611686018427387904	663	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	560	3708	hv-cinder-83998	S-1-5-18	4/29/2022 6:41:22 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Namespace = root\virtualization\v2; NotificationQuery = SELECT * FROM __InstanceCreationEvent WITHIN 2 WHERE TargetInstance ISA 'Msvm_SyntheticEthernetPortSettingData' ; UserName = NT AUTHORITY\SYSTEM; ClientProcessID = 5068, ClientMachine = HV-CINDER-83998; PossibleCause = Temporary	5860	0	4611686018427387904	662	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	560	3708	hv-cinder-83998	S-1-5-18	4/29/2022 6:41:22 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Namespace = root\virtualization\v2; NotificationQuery = SELECT EnabledState, TargetInstance FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA 'Msvm_ComputerSystem' AND TargetInstance.EnabledState != PreviousInstance.EnabledState AND (TargetInstance.EnabledState = '2' OR TargetInstance.EnabledState = '3' OR TargetInstance.EnabledState = '32768' OR TargetInstance.EnabledState = '32769'); UserName = NT AUTHORITY\SYSTEM; ClientProcessID = 1188, ClientMachine = HV-CINDER-83998; PossibleCause = Temporary	5860	0	4611686018427387904	661	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	560	3708	hv-cinder-83998	S-1-5-18	4/29/2022 6:41:19 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WMIProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1908; ProviderPath = %systemroot%\system32\wbem\wmiprov.dll	5857	0	4611686018427387904	660	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	1908	5092	hv-cinder-83998	S-1-5-18	4/29/2022 6:41:16 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Win32_WIN32_TERMINALSERVICE_Prov provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1416; ProviderPath = %SystemRoot%\system32\tscfgwmi.dll	5857	0	4611686018427387904	659	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	1416	872	hv-cinder-83998	S-1-5-20	4/29/2022 6:41:02 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4272; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll	5857	0	4611686018427387904	658	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	4272	4116	hv-cinder-83998	S-1-5-18	4/29/2022 6:40:52 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1416; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll	5857	0	4611686018427387904	657	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	1416	872	hv-cinder-83998	S-1-5-20	4/29/2022 6:40:52 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1416; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll	5857	0	4611686018427387904	656	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	1416	872	hv-cinder-83998	S-1-5-20	4/29/2022 6:40:52 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WMIProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1908; ProviderPath = %systemroot%\system32\wbem\wmiprov.dll	5857	0	4611686018427387904	655	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	1908	5092	hv-cinder-83998	S-1-5-18	4/29/2022 6:30:55 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32a provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1784; ProviderPath = %systemroot%\system32\wbem\wmipcima.dll	5857	0	4611686018427387904	654	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	1784	4344	hv-cinder-83998	S-1-5-20	4/29/2022 6:29:54 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Win32_WIN32_TERMINALSERVICE_Prov provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1784; ProviderPath = %SystemRoot%\system32\tscfgwmi.dll	5857	0	4611686018427387904	653	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	1784	3704	hv-cinder-83998	S-1-5-20	4/29/2022 6:29:53 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1784; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll	5857	0	4611686018427387904	652	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	1784	4344	hv-cinder-83998	S-1-5-20	4/29/2022 6:29:53 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
MSIProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 832; ProviderPath = %systemroot%\system32\wbem\msiprov.dll	5857	0	4611686018427387904	651	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	832	3504	hv-cinder-83998	S-1-5-18	4/29/2022 6:00:06 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WMIProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 832; ProviderPath = %systemroot%\system32\wbem\wmiprov.dll	5857	0	4611686018427387904	650	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	832	3504	hv-cinder-83998	S-1-5-18	4/29/2022 5:58:58 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WMIProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 832; ProviderPath = %systemroot%\system32\wbem\wmiprov.dll	5857	0	4611686018427387904	649	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	832	3504	hv-cinder-83998	S-1-5-18	4/29/2022 5:58:58 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2640; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll	5857	0	4611686018427387904	648	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2640	4124	hv-cinder-83998	S-1-5-20	4/29/2022 5:58:39 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {198F1FE5-5BF2-0000-B422-8F19F25BD801}; ClientMachine = HV-CINDER-83998; User = HV-CINDER-83998\Admin; ClientProcessId = 1392; Component = Core; Operation = Start IWbemServices::ExecNotificationQuery - root\virtualization\v2 : SELECT * FROM __InstanceDeletionEvent WITHIN 2 WHERE TargetInstance ISA 'Msvm_ConcreteJob'; ResultCode = 0x800706BE; PossibleCause = Could not send status to client	5858	2	4611686018427387904	647	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	560	2540	hv-cinder-83998	S-1-5-18	4/29/2022 5:56:57 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {198F1FE5-5BF2-0000-B422-8F19F25BD801}; ClientMachine = HV-CINDER-83998; User = HV-CINDER-83998\Admin; ClientProcessId = 1392; Component = Unknown; Operation = Start IWbemServices::ExecNotificationQuery - root\virtualization\v2 : SELECT * FROM __InstanceDeletionEvent WITHIN 2 WHERE TargetInstance ISA 'Msvm_ConcreteJob'; ResultCode = 0x80041032; PossibleCause = Unknown	5858	2	4611686018427387904	646	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	560	2596	hv-cinder-83998	S-1-5-18	4/29/2022 5:56:57 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {198F1FE5-5BF2-0000-B422-8F19F25BD801}; ClientMachine = HV-CINDER-83998; User = HV-CINDER-83998\Admin; ClientProcessId = 1392; Component = Unknown; Operation = Start IWbemServices::ExecNotificationQuery - root\virtualization\v2 : SELECT * FROM __InstanceModificationEvent WITHIN 2 WHERE TargetInstance ISA 'Msvm_ConcreteJob'; ResultCode = 0x80041032; PossibleCause = Unknown	5858	2	4611686018427387904	645	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	560	2596	hv-cinder-83998	S-1-5-18	4/29/2022 5:56:55 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Namespace = root\virtualization\v2; NotificationQuery = SELECT * FROM __InstanceDeletionEvent WITHIN 2 WHERE TargetInstance ISA 'Msvm_ConcreteJob'; UserName = HV-CINDER-83998\Admin; ClientProcessID = 1392, ClientMachine = HV-CINDER-83998; PossibleCause = Temporary	5860	0	4611686018427387904	644	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	560	2596	hv-cinder-83998	S-1-5-18	4/29/2022 5:56:55 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Namespace = root\virtualization\v2; NotificationQuery = SELECT * FROM __InstanceModificationEvent WITHIN 2 WHERE TargetInstance ISA 'Msvm_ConcreteJob'; UserName = HV-CINDER-83998\Admin; ClientProcessID = 1392, ClientMachine = HV-CINDER-83998; PossibleCause = Temporary	5860	0	4611686018427387904	643	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	560	2596	hv-cinder-83998	S-1-5-18	4/29/2022 5:56:55 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NetAdapterCim provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1348; ProviderPath = %systemroot%\system32\wbem\NetAdapterCim.dll	5857	0	4611686018427387904	642	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	1348	1432	hv-cinder-83998	S-1-5-19	4/29/2022 5:56:55 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
nettcpip provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2928; ProviderPath = %systemroot%\system32\wbem\NetTCPIP.dll	5857	0	4611686018427387904	641	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2928	3164	hv-cinder-83998	S-1-5-20	4/29/2022 5:56:52 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
MSiSCSITargetProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2584; ProviderPath = C:\windows\system32\wbem\SmIscsiTargetProv.dll	5857	0	4611686018427387904	640	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2584	1496	hv-cinder-83998	S-1-5-20	4/29/2022 5:56:51 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WinTargetProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1756; ProviderPath = C:\windows\system32\wbem\WTWMIProv.dll	5857	0	4611686018427387904	639	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	1756	4056	hv-cinder-83998	S-1-5-19	4/29/2022 5:56:51 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WMIProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 832; ProviderPath = %systemroot%\system32\wbem\wmiprov.dll	5857	0	4611686018427387904	638	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	832	3504	hv-cinder-83998	S-1-5-18	4/29/2022 5:56:51 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
MSiSCSITargetProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2584; ProviderPath = C:\windows\system32\wbem\SmIscsiTargetProv.dll	5857	0	4611686018427387904	637	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2584	2408	hv-cinder-83998	S-1-5-20	4/29/2022 5:56:51 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Win32_WIN32_TERMINALSERVICE_Prov provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2928; ProviderPath = %SystemRoot%\system32\tscfgwmi.dll	5857	0	4611686018427387904	636	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2928	3036	hv-cinder-83998	S-1-5-20	4/29/2022 5:56:38 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
wfascim provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2928; ProviderPath = %systemroot%\system32\wbem\wfascim.dll	5857	0	4611686018427387904	635	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2928	3164	hv-cinder-83998	S-1-5-20	4/29/2022 5:56:35 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2156; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll	5857	0	4611686018427387904	634	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2156	3984	hv-cinder-83998	S-1-5-18	4/29/2022 5:55:58 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2928; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll	5857	0	4611686018427387904	633	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2928	3036	hv-cinder-83998	S-1-5-20	4/29/2022 5:55:58 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2928; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll	5857	0	4611686018427387904	632	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2928	3036	hv-cinder-83998	S-1-5-20	4/29/2022 5:55:52 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = HV-CINDER-83998; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3956; Component = Unknown; Operation = Start IWbemServices::CreateInstanceEnum - root\wmi : MSiSCSI_PortalInfoClass; ResultCode = 0x8004100C; PossibleCause = Unknown	5858	2	4611686018427387904	631	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	560	168	hv-cinder-83998	S-1-5-18	4/29/2022 5:55:15 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = HV-CINDER-83998; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3956; Component = Unknown; Operation = Start IWbemServices::CreateInstanceEnum - root\wmi : MS_SM_AdapterInformationQuery; ResultCode = 0x8004100C; PossibleCause = Unknown	5858	2	4611686018427387904	630	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	560	168	hv-cinder-83998	S-1-5-18	4/29/2022 5:55:15 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WMIProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 832; ProviderPath = %systemroot%\system32\wbem\wmiprov.dll	5857	0	4611686018427387904	629	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	832	3504	hv-cinder-83998	S-1-5-18	4/29/2022 5:55:14 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = HV-CINDER-83998; User = HV-CINDER-83998\cloudbase-init; ClientProcessId = 3160; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\cimv2 : SELECT RemainingWindowsReArmCount, KeyManagementServiceListeningPort, KeyManagementServiceDnsPublishing, KeyManagementServiceLowPriority, ClientMachineId, KeyManagementServiceHostCaching, Version FROM SoftwareLicensingService; ResultCode = 0x80041032; PossibleCause = Unknown	5858	2	4611686018427387904	628	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	560	2396	hv-cinder-83998	S-1-5-18	4/29/2022 5:55:10 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
SppProvider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2928; ProviderPath = %SystemRoot%\System32\sppwmi.dll	5857	0	4611686018427387904	627	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2928	3036	hv-cinder-83998	S-1-5-20	4/29/2022 5:55:09 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = HV-CINDER-83998; User = NT AUTHORITY\SYSTEM; ClientProcessId = 2220; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\Microsoft\Windows\DeviceGuard : SELECT AvailableSecurityProperties FROM Win32_DeviceGuard ; ResultCode = 0x80041032; PossibleCause = Unknown	5858	2	4611686018427387904	626	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	560	2832	hv-cinder-83998	S-1-5-18	4/29/2022 5:55:09 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = HV-CINDER-83998; User = NT AUTHORITY\SYSTEM; ClientProcessId = 2220; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\Microsoft\Windows\DeviceGuard : SELECT RequiredSecurityProperties FROM Win32_DeviceGuard ; ResultCode = 0x80041032; PossibleCause = Unknown	5858	2	4611686018427387904	625	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	560	1964	hv-cinder-83998	S-1-5-18	4/29/2022 5:55:09 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = HV-CINDER-83998; User = NT AUTHORITY\SYSTEM; ClientProcessId = 2220; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\Microsoft\Windows\DeviceGuard : SELECT SecurityServicesConfigured FROM Win32_DeviceGuard ; ResultCode = 0x80041032; PossibleCause = Unknown	5858	2	4611686018427387904	624	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	560	2832	hv-cinder-83998	S-1-5-18	4/29/2022 5:55:09 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Win32_TpmProvider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2928; ProviderPath = C:\Windows\system32\wbem\Win32_TPM.dll	5857	0	4611686018427387904	623	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2928	3036	hv-cinder-83998	S-1-5-20	4/29/2022 5:55:09 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = HV-CINDER-83998; User = NT AUTHORITY\SYSTEM; ClientProcessId = 2220; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\Microsoft\Windows\DeviceGuard : SELECT VirtualizationBasedSecurityStatus FROM Win32_DeviceGuard ; ResultCode = 0x80041032; PossibleCause = Unknown	5858	2	4611686018427387904	622	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	560	2832	hv-cinder-83998	S-1-5-18	4/29/2022 5:55:08 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = HV-CINDER-83998; User = NT AUTHORITY\SYSTEM; ClientProcessId = 2220; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\Microsoft\Windows\DeviceGuard : SELECT SecurityServicesRunning FROM Win32_DeviceGuard ; ResultCode = 0x80041032; PossibleCause = Unknown	5858	2	4611686018427387904	621	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	560	1596	hv-cinder-83998	S-1-5-18	4/29/2022 5:55:08 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = HV-CINDER-83998; User = NT AUTHORITY\SYSTEM; ClientProcessId = 2220; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\Microsoft\Windows\DeviceGuard : SELECT SecurityServicesRunning FROM Win32_DeviceGuard ; ResultCode = 0x80041032; PossibleCause = Unknown	5858	2	4611686018427387904	620	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	560	1596	hv-cinder-83998	S-1-5-18	4/29/2022 5:55:08 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = HV-CINDER-83998; User = NT AUTHORITY\SYSTEM; ClientProcessId = 2220; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\Microsoft\Windows\DeviceGuard : SELECT AvailableSecurityProperties FROM Win32_DeviceGuard ; ResultCode = 0x80041032; PossibleCause = Unknown	5858	2	4611686018427387904	619	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	560	2832	hv-cinder-83998	S-1-5-18	4/29/2022 5:55:08 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = HV-CINDER-83998; User = NT AUTHORITY\SYSTEM; ClientProcessId = 2220; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\Microsoft\Windows\DeviceGuard : SELECT RequiredSecurityProperties FROM Win32_DeviceGuard ; ResultCode = 0x80041032; PossibleCause = Unknown	5858	2	4611686018427387904	618	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	560	1596	hv-cinder-83998	S-1-5-18	4/29/2022 5:55:08 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = HV-CINDER-83998; User = NT AUTHORITY\SYSTEM; ClientProcessId = 2220; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\Microsoft\Windows\DeviceGuard : SELECT VirtualizationBasedSecurityStatus FROM Win32_DeviceGuard ; ResultCode = 0x80041032; PossibleCause = Unknown	5858	2	4611686018427387904	617	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	560	1596	hv-cinder-83998	S-1-5-18	4/29/2022 5:55:08 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = HV-CINDER-83998; User = NT AUTHORITY\SYSTEM; ClientProcessId = 2220; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\Microsoft\Windows\DeviceGuard : SELECT SecurityServicesRunning FROM Win32_DeviceGuard ; ResultCode = 0x80041032; PossibleCause = Unknown	5858	2	4611686018427387904	616	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	560	1596	hv-cinder-83998	S-1-5-18	4/29/2022 5:55:08 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = HV-CINDER-83998; User = NT AUTHORITY\SYSTEM; ClientProcessId = 2220; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\Microsoft\Windows\DeviceGuard : SELECT SecurityServicesRunning FROM Win32_DeviceGuard ; ResultCode = 0x80041032; PossibleCause = Unknown	5858	2	4611686018427387904	615	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	560	1596	hv-cinder-83998	S-1-5-18	4/29/2022 5:55:08 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Win32_DeviceGuard provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2928; ProviderPath = %SystemRoot%\System32\Win32_DeviceGuard.dll	5857	0	4611686018427387904	614	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2928	3036	hv-cinder-83998	S-1-5-20	4/29/2022 5:55:08 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = HV-CINDER-83998; User = NT AUTHORITY\SYSTEM; ClientProcessId = 2220; Component = Unknown; Operation = Start IWbemServices::ExecQuery - ROOT\CIMV2 : select ChassisTypes from Win32_SystemEnclosure; ResultCode = 0x80041032; PossibleCause = Unknown	5858	2	4611686018427387904	613	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	560	1964	hv-cinder-83998	S-1-5-18	4/29/2022 5:55:02 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = HV-CINDER-83998; User = NT AUTHORITY\SYSTEM; ClientProcessId = 2220; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\CIMV2 : SELECT SMBIOSAssetTag FROM Win32_SystemEnclosure ; ResultCode = 0x80041032; PossibleCause = Unknown	5858	2	4611686018427387904	612	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	560	2396	hv-cinder-83998	S-1-5-18	4/29/2022 5:55:01 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = HV-CINDER-83998; User = NT AUTHORITY\SYSTEM; ClientProcessId = 2220; Component = Unknown; Operation = Start IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT ID FROM Win32_ServerFeature; ResultCode = 0x80041032; PossibleCause = Unknown	5858	2	4611686018427387904	611	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	560	2820	hv-cinder-83998	S-1-5-18	4/29/2022 5:54:57 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2156; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll	5857	0	4611686018427387904	610	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2156	1144	hv-cinder-83998	S-1-5-18	4/29/2022 5:54:52 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
ServerFeatureProvider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2928; ProviderPath = %windir%\system32\wbem\servercompprov.dll	5857	0	4611686018427387904	609	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2928	2956	hv-cinder-83998	S-1-5-20	4/29/2022 5:54:52 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {7358B9BE-6E19-4C03-8279-D6B2A5BF0D25}; ClientMachine = HV-CINDER-83998; User = ; ClientProcessId = 560; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{FC491EF1-C4AA-4CE1-B329-414B101DB823}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	608	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	560	2844	hv-cinder-83998	S-1-5-18	4/29/2022 5:54:34 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {7358B9BE-6E19-4C03-8279-D6B2A5BF0D25}; ClientMachine = HV-CINDER-83998; User = ; ClientProcessId = 560; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{fbf687e6-f063-4d9f-9f4f-fd9a26acdd5f}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	607	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	560	2844	hv-cinder-83998	S-1-5-18	4/29/2022 5:54:34 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {7358B9BE-6E19-4C03-8279-D6B2A5BF0D25}; ClientMachine = HV-CINDER-83998; User = ; ClientProcessId = 560; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{FB2CA36D-0B40-4307-821B-A13B252DE56C}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	606	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	560	2844	hv-cinder-83998	S-1-5-18	4/29/2022 5:54:34 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {7358B9BE-6E19-4C03-8279-D6B2A5BF0D25}; ClientMachine = HV-CINDER-83998; User = ; ClientProcessId = 560; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{f3ccc681-b74c-4060-9f26-cd84525dca2a}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	605	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	560	2844	hv-cinder-83998	S-1-5-18	4/29/2022 5:54:34 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {7358B9BE-6E19-4C03-8279-D6B2A5BF0D25}; ClientMachine = HV-CINDER-83998; User = ; ClientProcessId = 560; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{F312195E-3D9D-447A-A3F5-08DFFA24735E}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	604	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	560	2844	hv-cinder-83998	S-1-5-18	4/29/2022 5:54:34 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {7358B9BE-6E19-4C03-8279-D6B2A5BF0D25}; ClientMachine = HV-CINDER-83998; User = ; ClientProcessId = 560; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{E62688F0-25FD-4c90-BFF5-F508B9D2E31F}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	603	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	560	2844	hv-cinder-83998	S-1-5-18	4/29/2022 5:54:34 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {7358B9BE-6E19-4C03-8279-D6B2A5BF0D25}; ClientMachine = HV-CINDER-83998; User = ; ClientProcessId = 560; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{E5094040-C46C-4115-B030-04FB2E545B00}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	602	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	560	2844	hv-cinder-83998	S-1-5-18	4/29/2022 5:54:34 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {7358B9BE-6E19-4C03-8279-D6B2A5BF0D25}; ClientMachine = HV-CINDER-83998; User = ; ClientProcessId = 560; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{E4F48E54-F38D-4884-BFB9-D4D2E5729C18}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	601	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	560	2844	hv-cinder-83998	S-1-5-18	4/29/2022 5:54:34 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {7358B9BE-6E19-4C03-8279-D6B2A5BF0D25}; ClientMachine = HV-CINDER-83998; User = ; ClientProcessId = 560; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{e437bc1c-aa7d-11d2-a382-00c04f991e27}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	600	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	560	2844	hv-cinder-83998	S-1-5-18	4/29/2022 5:54:34 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {7358B9BE-6E19-4C03-8279-D6B2A5BF0D25}; ClientMachine = HV-CINDER-83998; User = ; ClientProcessId = 560; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{CF7639F3-ABA2-41DB-97F2-81E2C5DBFC5D}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	599	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	560	2844	hv-cinder-83998	S-1-5-18	4/29/2022 5:54:34 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {7358B9BE-6E19-4C03-8279-D6B2A5BF0D25}; ClientMachine = HV-CINDER-83998; User = ; ClientProcessId = 560; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{cdeafc3d-948d-49dd-ab12-e578ba4af7aa}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	598	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	560	2844	hv-cinder-83998	S-1-5-18	4/29/2022 5:54:34 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {7358B9BE-6E19-4C03-8279-D6B2A5BF0D25}; ClientMachine = HV-CINDER-83998; User = ; ClientProcessId = 560; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{c6dc5466-785a-11d2-84d0-00c04fb169f7}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	597	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	560	2844	hv-cinder-83998	S-1-5-18	4/29/2022 5:54:34 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {7358B9BE-6E19-4C03-8279-D6B2A5BF0D25}; ClientMachine = HV-CINDER-83998; User = ; ClientProcessId = 560; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{C631DF4C-088F-4156-B058-4375F0853CD8}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	596	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	560	2844	hv-cinder-83998	S-1-5-18	4/29/2022 5:54:34 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {7358B9BE-6E19-4C03-8279-D6B2A5BF0D25}; ClientMachine = HV-CINDER-83998; User = ; ClientProcessId = 560; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{C418DD9D-0D14-4efb-8FBF-CFE535C8FAC7}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	595	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	560	2844	hv-cinder-83998	S-1-5-18	4/29/2022 5:54:34 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {7358B9BE-6E19-4C03-8279-D6B2A5BF0D25}; ClientMachine = HV-CINDER-83998; User = ; ClientProcessId = 560; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{C34B2751-1CF4-44F5-9262-C3FC39666591}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	594	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	560	2844	hv-cinder-83998	S-1-5-18	4/29/2022 5:54:34 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {7358B9BE-6E19-4C03-8279-D6B2A5BF0D25}; ClientMachine = HV-CINDER-83998; User = ; ClientProcessId = 560; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{BC75B1ED-5833-4858-9BB8-CBF0B166DF9D}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	593	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	560	2844	hv-cinder-83998	S-1-5-18	4/29/2022 5:54:34 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {7358B9BE-6E19-4C03-8279-D6B2A5BF0D25}; ClientMachine = HV-CINDER-83998; User = ; ClientProcessId = 560; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{BA649533-0AAC-4E04-B9BC-4DBAE0325B12}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	592	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	560	2844	hv-cinder-83998	S-1-5-18	4/29/2022 5:54:34 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {7358B9BE-6E19-4C03-8279-D6B2A5BF0D25}; ClientMachine = HV-CINDER-83998; User = ; ClientProcessId = 560; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{B587E2B1-4D59-4e7e-AED9-22B9DF11D053}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	591	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	560	2844	hv-cinder-83998	S-1-5-18	4/29/2022 5:54:34 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {7358B9BE-6E19-4C03-8279-D6B2A5BF0D25}; ClientMachine = HV-CINDER-83998; User = ; ClientProcessId = 560; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{B087BE9D-ED37-454f-AF9C-04291E351182}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	590	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	560	2844	hv-cinder-83998	S-1-5-18	4/29/2022 5:54:34 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {7358B9BE-6E19-4C03-8279-D6B2A5BF0D25}; ClientMachine = HV-CINDER-83998; User = ; ClientProcessId = 560; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{AADCED64-746C-4633-A97C-D61349046527}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	589	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	560	2844	hv-cinder-83998	S-1-5-18	4/29/2022 5:54:34 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {7358B9BE-6E19-4C03-8279-D6B2A5BF0D25}; ClientMachine = HV-CINDER-83998; User = ; ClientProcessId = 560; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{A3F3E39B-5D83-4940-B954-28315B82F0A8}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	588	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	560	2844	hv-cinder-83998	S-1-5-18	4/29/2022 5:54:34 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {7358B9BE-6E19-4C03-8279-D6B2A5BF0D25}; ClientMachine = HV-CINDER-83998; User = ; ClientProcessId = 560; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{91FBB303-0CD5-4055-BF42-E512A681B325}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	587	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	560	2844	hv-cinder-83998	S-1-5-18	4/29/2022 5:54:34 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {7358B9BE-6E19-4C03-8279-D6B2A5BF0D25}; ClientMachine = HV-CINDER-83998; User = ; ClientProcessId = 560; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{8A28E2C5-8D06-49A4-A08C-632DAA493E17}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	586	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	560	2844	hv-cinder-83998	S-1-5-18	4/29/2022 5:54:34 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {7358B9BE-6E19-4C03-8279-D6B2A5BF0D25}; ClientMachine = HV-CINDER-83998; User = ; ClientProcessId = 560; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{827D319E-6EAC-11D2-A4EA-00C04F79F83A}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	585	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	560	2844	hv-cinder-83998	S-1-5-18	4/29/2022 5:54:34 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {7358B9BE-6E19-4C03-8279-D6B2A5BF0D25}; ClientMachine = HV-CINDER-83998; User = ; ClientProcessId = 560; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{7B849a69-220F-451E-B3FE-2CB811AF94AE}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	584	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	560	2844	hv-cinder-83998	S-1-5-18	4/29/2022 5:54:34 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {7358B9BE-6E19-4C03-8279-D6B2A5BF0D25}; ClientMachine = HV-CINDER-83998; User = ; ClientProcessId = 560; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{7933F41E-56F8-41d6-A31C-4148A711EE93}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	583	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	560	2844	hv-cinder-83998	S-1-5-18	4/29/2022 5:54:34 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {7358B9BE-6E19-4C03-8279-D6B2A5BF0D25}; ClientMachine = HV-CINDER-83998; User = ; ClientProcessId = 560; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{74EE6C03-5363-4554-B161-627540339CAB}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	582	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	560	2844	hv-cinder-83998	S-1-5-18	4/29/2022 5:54:34 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {7358B9BE-6E19-4C03-8279-D6B2A5BF0D25}; ClientMachine = HV-CINDER-83998; User = ; ClientProcessId = 560; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{728EE579-943C-4519-9EF7-AB56765798ED}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	581	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	560	2844	hv-cinder-83998	S-1-5-18	4/29/2022 5:54:34 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {7358B9BE-6E19-4C03-8279-D6B2A5BF0D25}; ClientMachine = HV-CINDER-83998; User = ; ClientProcessId = 560; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{7150F9BF-48AD-4da4-A49C-29EF4A8369BA}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	580	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	560	2844	hv-cinder-83998	S-1-5-18	4/29/2022 5:54:34 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {7358B9BE-6E19-4C03-8279-D6B2A5BF0D25}; ClientMachine = HV-CINDER-83998; User = ; ClientProcessId = 560; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{6A4C88C6-C502-4f74-8F60-2CB23EDC24E2}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	579	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	560	2844	hv-cinder-83998	S-1-5-18	4/29/2022 5:54:34 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {7358B9BE-6E19-4C03-8279-D6B2A5BF0D25}; ClientMachine = HV-CINDER-83998; User = ; ClientProcessId = 560; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{6232C319-91AC-4931-9385-E70C2B099F0E}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	578	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	560	2844	hv-cinder-83998	S-1-5-18	4/29/2022 5:54:34 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {7358B9BE-6E19-4C03-8279-D6B2A5BF0D25}; ClientMachine = HV-CINDER-83998; User = ; ClientProcessId = 560; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{4CFB60C1-FAA6-47f1-89AA-0B18730C9FD3}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	577	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	560	2844	hv-cinder-83998	S-1-5-18	4/29/2022 5:54:34 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {7358B9BE-6E19-4C03-8279-D6B2A5BF0D25}; ClientMachine = HV-CINDER-83998; User = ; ClientProcessId = 560; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{4bcd6cde-777b-48b6-9804-43568e23545d}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	576	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	560	2844	hv-cinder-83998	S-1-5-18	4/29/2022 5:54:34 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {7358B9BE-6E19-4C03-8279-D6B2A5BF0D25}; ClientMachine = HV-CINDER-83998; User = ; ClientProcessId = 560; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{4B7C3B0F-E993-4E06-A241-3FBE06943684}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	575	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	560	2844	hv-cinder-83998	S-1-5-18	4/29/2022 5:54:34 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {7358B9BE-6E19-4C03-8279-D6B2A5BF0D25}; ClientMachine = HV-CINDER-83998; User = ; ClientProcessId = 560; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{42B5FAAE-6536-11d2-AE5A-0000F87571E3}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	574	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	560	2844	hv-cinder-83998	S-1-5-18	4/29/2022 5:54:34 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {7358B9BE-6E19-4C03-8279-D6B2A5BF0D25}; ClientMachine = HV-CINDER-83998; User = ; ClientProcessId = 560; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{426031c0-0b47-4852-b0ca-ac3d37bfcb39}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	573	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	560	2844	hv-cinder-83998	S-1-5-18	4/29/2022 5:54:34 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {7358B9BE-6E19-4C03-8279-D6B2A5BF0D25}; ClientMachine = HV-CINDER-83998; User = ; ClientProcessId = 560; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{3A0DBA37-F8B2-4356-83DE-3E90BD5C261F}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	572	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	560	2844	hv-cinder-83998	S-1-5-18	4/29/2022 5:54:34 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {7358B9BE-6E19-4C03-8279-D6B2A5BF0D25}; ClientMachine = HV-CINDER-83998; User = ; ClientProcessId = 560; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{3610eda5-77ef-11d2-8dc5-00c04fa31a66}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	571	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	560	2844	hv-cinder-83998	S-1-5-18	4/29/2022 5:54:34 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {7358B9BE-6E19-4C03-8279-D6B2A5BF0D25}; ClientMachine = HV-CINDER-83998; User = ; ClientProcessId = 560; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{2BFCC077-22D2-48DE-BDE1-2F618D9B476D}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	570	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	560	2844	hv-cinder-83998	S-1-5-18	4/29/2022 5:54:34 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {7358B9BE-6E19-4C03-8279-D6B2A5BF0D25}; ClientMachine = HV-CINDER-83998; User = ; ClientProcessId = 560; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{2A8FDC61-2347-4C87-92F6-B05EB91A201A}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	569	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	560	2844	hv-cinder-83998	S-1-5-18	4/29/2022 5:54:34 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {7358B9BE-6E19-4C03-8279-D6B2A5BF0D25}; ClientMachine = HV-CINDER-83998; User = ; ClientProcessId = 560; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{1A6364EB-776B-4120-ADE1-B63A406A76B5}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	568	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	560	2844	hv-cinder-83998	S-1-5-18	4/29/2022 5:54:34 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {7358B9BE-6E19-4C03-8279-D6B2A5BF0D25}; ClientMachine = HV-CINDER-83998; User = ; ClientProcessId = 560; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{17D89FEC-5C44-4972-B12D-241CAEF74509}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	567	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	560	2844	hv-cinder-83998	S-1-5-18	4/29/2022 5:54:34 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {7358B9BE-6E19-4C03-8279-D6B2A5BF0D25}; ClientMachine = HV-CINDER-83998; User = ; ClientProcessId = 560; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{16be69fa-4209-4250-88cb-716cf41954e0}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	566	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	560	2844	hv-cinder-83998	S-1-5-18	4/29/2022 5:54:34 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {7358B9BE-6E19-4C03-8279-D6B2A5BF0D25}; ClientMachine = HV-CINDER-83998; User = ; ClientProcessId = 560; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{169EBF44-942F-4C43-87CE-13C93996EBBE}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	565	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	560	2844	hv-cinder-83998	S-1-5-18	4/29/2022 5:54:34 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {7358B9BE-6E19-4C03-8279-D6B2A5BF0D25}; ClientMachine = HV-CINDER-83998; User = ; ClientProcessId = 560; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{0E28E245-9368-4853-AD84-6DA3BA35BB75}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	564	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	560	2844	hv-cinder-83998	S-1-5-18	4/29/2022 5:54:34 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {7358B9BE-6E19-4C03-8279-D6B2A5BF0D25}; ClientMachine = HV-CINDER-83998; User = ; ClientProcessId = 560; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{0ACDD40C-75AC-47ab-BAA0-BF6DE7E7FE63}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	563	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	560	2844	hv-cinder-83998	S-1-5-18	4/29/2022 5:54:34 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32a provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2928; ProviderPath = %systemroot%\system32\wbem\wmipcima.dll	5857	0	4611686018427387904	562	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2928	2956	hv-cinder-83998	S-1-5-20	4/29/2022 5:54:28 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Namespace = //./root/CIMV2; NotificationQuery = select * from MSFT_SCMEventLogEvent; OwnerName = S-1-5-32-544; HostProcessID = 560; Provider= SCM Event Provider, queryID = 0; PossibleCause = Permanent	5859	0	4611686018427387904	561	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	560	3812	hv-cinder-83998	S-1-5-18	4/29/2022 5:54:27 PM	198f1fe5-5bf2-0001-1d20-8f19f25bd801	microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Namespace = root\virtualization\v2; NotificationQuery = SELECT * FROM __ClassOperationEvent; UserName = .\SYSTEM; ClientProcessID = 0, ClientMachine = ; PossibleCause = Temporary	5860	0	4611686018427387904	560	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	560	2844	hv-cinder-83998	S-1-5-18	4/29/2022 5:54:27 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Namespace = //./root/subscription; Eventfilter = SCM Event Log Filter (refer to its activate eventid:5859); Consumer = NTEventLogEventConsumer="SCM Event Log Consumer"; PossibleCause = Binding EventFilter: instance of __EventFilter { CreatorSID = {1, 2, 0, 0, 0, 0, 0, 5, 32, 0, 0, 0, 32, 2, 0, 0}; EventNamespace = "root\\cimv2"; Name = "SCM Event Log Filter"; Query = "select * from MSFT_SCMEventLogEvent"; QueryLanguage = "WQL"; }; Perm. Consumer: instance of NTEventLogEventConsumer { Category = 0; CreatorSID = {1, 2, 0, 0, 0, 0, 0, 5, 32, 0, 0, 0, 32, 2, 0, 0}; EventType = 1; Name = "SCM Event Log Consumer"; NameOfUserSIDProperty = "sid"; SourceName = "Service Control Manager"; };	5861	0	4611686018427387904	559	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	560	3808	hv-cinder-83998	S-1-5-18	4/29/2022 5:54:27 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2928; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll	5857	0	4611686018427387904	558	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2928	2956	hv-cinder-83998	S-1-5-20	4/29/2022 5:54:21 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = HV-CINDER-83998; User = NT AUTHORITY\SYSTEM; ClientProcessId = 2556; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\virtualization\v2 : Msvm_ResourcePoolComponent.Name="Microsoft\|RDV Integration Component Resource Pool\|V2.0"; ResultCode = 0x80041010; PossibleCause = Unknown	5858	2	4611686018427387904	557	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	560	2856	hv-cinder-83998	S-1-5-18	4/29/2022 5:54:21 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = HV-CINDER-83998; User = NT AUTHORITY\SYSTEM; ClientProcessId = 2120; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User : __Namespace.name="S_1_5_21_1352204872_2778957378_3313825891_500"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	556	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	560	2888	hv-cinder-83998	S-1-5-18	4/29/2022 5:54:21 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-R7AGVSTP5AE; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3016; Component = Unknown; Operation = Start IWbemServices::CreateInstanceEnum - root\wmi : MSiSCSI_PortalInfoClass; ResultCode = 0x8004100A; PossibleCause = Unknown	5858	2	4611686018427387904	555	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	520	2540	WIN-5T344G8GM1H	S-1-5-18	4/29/2022 5:53:40 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-R7AGVSTP5AE; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3016; Component = Unknown; Operation = Start IWbemServices::CreateInstanceEnum - root\wmi : MS_SM_AdapterInformationQuery; ResultCode = 0x8004100A; PossibleCause = Unknown	5858	2	4611686018427387904	554	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	520	2540	WIN-5T344G8GM1H	S-1-5-18	4/29/2022 5:53:40 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-R7AGVSTP5AE; User = NT AUTHORITY\SYSTEM; ClientProcessId = 2140; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\virtualization\v2 : Msvm_ResourcePoolComponent.Name="Microsoft\|RDV Integration Component Resource Pool\|V2.0"; ResultCode = 0x80041010; PossibleCause = Unknown	5858	2	4611686018427387904	553	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	520	2360	WIN-5T344G8GM1H	S-1-5-18	4/29/2022 5:52:26 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-R7AGVSTP5AE; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1756; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\cimv2 : select * from Win32_OperatingSystem; ResultCode = 0x8004100A; PossibleCause = Unknown	5858	2	4611686018427387904	552	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	520	2360	WIN-5T344G8GM1H	S-1-5-18	4/29/2022 5:52:26 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4848; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\wmi : select * from WDMClassesOfDriver where ClassName = "RNDISMPStatisticsOID"; ResultCode = 0x80041032; PossibleCause = Unknown	5858	2	4611686018427387904	551	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	976	3432	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:48:09 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4848; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\wmi : select * from WMIBinaryMofResource where Name = "C:\\windows\\System32\\drivers\\en-US\\netvsc.sys.mui[NdisMofResource]"; ResultCode = 0x80041032; PossibleCause = Unknown	5858	2	4611686018427387904	550	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	976	3432	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:48:09 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
MSVDS__PROVIDER provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4460; ProviderPath = %systemroot%\system32\wbem\vdswmi.dll	5857	0	4611686018427387904	549	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	4460	5048	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 9:46:31 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4460; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll	5857	0	4611686018427387904	548	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	4460	5048	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 9:46:31 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WMIProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4848; ProviderPath = %systemroot%\system32\wbem\wmiprov.dll	5857	0	4611686018427387904	547	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	4848	4776	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:45:30 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = WIN-5T344G8GM1H\Administrator; ClientProcessId = 4956; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\Microsoft\Windows\Defender : SELECT * FROM MSFT_MpComputerStatus; ResultCode = 0x80041032; PossibleCause = Unknown	5858	2	4611686018427387904	546	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	976	1176	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:42:52 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
ProtectionManagement provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3752; ProviderPath = "%ProgramData%\Microsoft\Windows Defender\Platform\4.12.17007.18011-0\ProtectionManagement.dll"	5857	0	4611686018427387904	545	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	3752	2228	WIN-5T344G8GM1H	S-1-5-19	1/19/2018 9:42:52 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
MsNetImPlatform provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2776; ProviderPath = %systemroot%\system32\wbem\ndisimplatcim.dll	5857	0	4611686018427387904	544	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2776	3064	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 9:42:52 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4120; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll	5857	0	4611686018427387904	543	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	4120	4148	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:42:50 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
nettcpip provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2776; ProviderPath = %systemroot%\system32\wbem\NetTCPIP.dll	5857	0	4611686018427387904	542	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2776	1292	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 9:42:48 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NetAdapterCim provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3752; ProviderPath = %systemroot%\system32\wbem\NetAdapterCim.dll	5857	0	4611686018427387904	541	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	3752	2228	WIN-5T344G8GM1H	S-1-5-19	1/19/2018 9:42:48 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2776; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll	5857	0	4611686018427387904	540	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2776	3064	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 9:42:48 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
MSVDS__PROVIDER provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2776; ProviderPath = %systemroot%\system32\wbem\vdswmi.dll	5857	0	4611686018427387904	539	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2776	3064	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 9:42:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32a provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2776; ProviderPath = %systemroot%\system32\wbem\wmipcima.dll	5857	0	4611686018427387904	538	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2776	3064	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 9:42:16 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4120; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll	5857	0	4611686018427387904	537	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	4120	4148	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:41:43 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
nettcpip provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2776; ProviderPath = %systemroot%\system32\wbem\NetTCPIP.dll	5857	0	4611686018427387904	536	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2776	1292	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 9:41:39 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NetAdapterCim provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3752; ProviderPath = %systemroot%\system32\wbem\NetAdapterCim.dll	5857	0	4611686018427387904	535	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	3752	2228	WIN-5T344G8GM1H	S-1-5-19	1/19/2018 9:41:39 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2776; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll	5857	0	4611686018427387904	534	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2776	2812	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 9:41:39 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Namespace = //./root/CIMV2; NotificationQuery = select * from MSFT_SCMEventLogEvent; OwnerName = S-1-5-32-544; HostProcessID = 976; Provider= SCM Event Provider, queryID = 0; PossibleCause = Permanent	5859	0	4611686018427387904	533	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	976	2172	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:41:32 AM	ad8d0f9c-9109-0001-0a10-8dad0991d301	microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Namespace = root\virtualization\v2; NotificationQuery = SELECT * FROM __ClassOperationEvent; UserName = .\SYSTEM; ClientProcessID = 0, ClientMachine = ; PossibleCause = Temporary	5860	0	4611686018427387904	532	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	976	2680	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:41:32 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Namespace = //./root/subscription; Eventfilter = SCM Event Log Filter (refer to its activate eventid:5859); Consumer = NTEventLogEventConsumer="SCM Event Log Consumer"; PossibleCause = Binding EventFilter: instance of __EventFilter { CreatorSID = {1, 2, 0, 0, 0, 0, 0, 5, 32, 0, 0, 0, 32, 2, 0, 0}; EventNamespace = "root\\cimv2"; Name = "SCM Event Log Filter"; Query = "select * from MSFT_SCMEventLogEvent"; QueryLanguage = "WQL"; }; Perm. Consumer: instance of NTEventLogEventConsumer { Category = 0; CreatorSID = {1, 2, 0, 0, 0, 0, 0, 5, 32, 0, 0, 0, 32, 2, 0, 0}; EventType = 1; Name = "SCM Event Log Consumer"; NameOfUserSIDProperty = "sid"; SourceName = "Service Control Manager"; };	5861	0	4611686018427387904	531	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	976	388	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:41:32 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{FC491EF1-C4AA-4CE1-B329-414B101DB823}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	530	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	976	2680	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:41:32 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{fbf687e6-f063-4d9f-9f4f-fd9a26acdd5f}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	529	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	976	2680	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:41:32 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{FB2CA36D-0B40-4307-821B-A13B252DE56C}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	528	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	976	2680	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:41:32 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{f3ccc681-b74c-4060-9f26-cd84525dca2a}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	527	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	976	2680	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:41:32 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{F312195E-3D9D-447A-A3F5-08DFFA24735E}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	526	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	976	2680	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:41:32 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{E62688F0-25FD-4c90-BFF5-F508B9D2E31F}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	525	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	976	2680	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:41:32 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{E5094040-C46C-4115-B030-04FB2E545B00}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	524	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	976	2680	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:41:32 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{E4F48E54-F38D-4884-BFB9-D4D2E5729C18}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	523	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	976	2680	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:41:32 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{e437bc1c-aa7d-11d2-a382-00c04f991e27}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	522	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	976	2680	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:41:32 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{CF7639F3-ABA2-41DB-97F2-81E2C5DBFC5D}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	521	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	976	2680	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:41:32 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{cdeafc3d-948d-49dd-ab12-e578ba4af7aa}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	520	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	976	2680	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:41:32 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{c6dc5466-785a-11d2-84d0-00c04fb169f7}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	519	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	976	2680	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:41:32 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{C631DF4C-088F-4156-B058-4375F0853CD8}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	518	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	976	2680	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:41:32 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{C418DD9D-0D14-4efb-8FBF-CFE535C8FAC7}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	517	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	976	2680	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:41:32 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{C34B2751-1CF4-44F5-9262-C3FC39666591}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	516	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	976	2680	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:41:32 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{BC75B1ED-5833-4858-9BB8-CBF0B166DF9D}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	515	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	976	2680	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:41:32 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{BA649533-0AAC-4E04-B9BC-4DBAE0325B12}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	514	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	976	2680	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:41:32 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{B587E2B1-4D59-4e7e-AED9-22B9DF11D053}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	513	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	976	2680	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:41:32 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{B087BE9D-ED37-454f-AF9C-04291E351182}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	512	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	976	2680	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:41:32 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{AADCED64-746C-4633-A97C-D61349046527}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	511	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	976	2680	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:41:32 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{A3F3E39B-5D83-4940-B954-28315B82F0A8}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	510	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	976	2680	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:41:32 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{91FBB303-0CD5-4055-BF42-E512A681B325}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	509	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	976	2680	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:41:32 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{8A28E2C5-8D06-49A4-A08C-632DAA493E17}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	508	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	976	2680	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:41:32 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{827D319E-6EAC-11D2-A4EA-00C04F79F83A}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	507	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	976	2680	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:41:32 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{7B849a69-220F-451E-B3FE-2CB811AF94AE}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	506	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	976	2680	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:41:32 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{7933F41E-56F8-41d6-A31C-4148A711EE93}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	505	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	976	2680	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:41:32 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{74EE6C03-5363-4554-B161-627540339CAB}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	504	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	976	2680	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:41:32 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{728EE579-943C-4519-9EF7-AB56765798ED}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	503	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	976	2680	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:41:32 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{7150F9BF-48AD-4da4-A49C-29EF4A8369BA}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	502	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	976	2680	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:41:32 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{6A4C88C6-C502-4f74-8F60-2CB23EDC24E2}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	501	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	976	2680	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:41:32 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{6232C319-91AC-4931-9385-E70C2B099F0E}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	500	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	976	2680	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:41:32 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{4CFB60C1-FAA6-47f1-89AA-0B18730C9FD3}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	499	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	976	2680	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:41:32 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{4bcd6cde-777b-48b6-9804-43568e23545d}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	498	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	976	2680	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:41:32 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{4B7C3B0F-E993-4E06-A241-3FBE06943684}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	497	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	976	2680	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:41:32 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{42B5FAAE-6536-11d2-AE5A-0000F87571E3}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	496	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	976	2680	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:41:32 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{426031c0-0b47-4852-b0ca-ac3d37bfcb39}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	495	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	976	2680	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:41:32 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{3A0DBA37-F8B2-4356-83DE-3E90BD5C261F}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	494	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	976	2680	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:41:32 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{3610eda5-77ef-11d2-8dc5-00c04fa31a66}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	493	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	976	2680	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:41:32 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{2BFCC077-22D2-48DE-BDE1-2F618D9B476D}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	492	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	976	2680	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:41:32 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{2A8FDC61-2347-4C87-92F6-B05EB91A201A}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	491	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	976	2680	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:41:32 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{1A6364EB-776B-4120-ADE1-B63A406A76B5}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	490	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	976	2680	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:41:32 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{17D89FEC-5C44-4972-B12D-241CAEF74509}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	489	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	976	2680	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:41:32 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{16be69fa-4209-4250-88cb-716cf41954e0}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	488	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	976	2680	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:41:32 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{169EBF44-942F-4C43-87CE-13C93996EBBE}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	487	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	976	2680	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:41:32 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{0E28E245-9368-4853-AD84-6DA3BA35BB75}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	486	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	976	2680	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:41:32 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{0ACDD40C-75AC-47ab-BAA0-BF6DE7E7FE63}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	485	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	976	2680	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:41:32 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2776; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll	5857	0	4611686018427387904	484	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2776	2848	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 9:41:31 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 2204; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\virtualization\v2 : Msvm_ResourcePoolComponent.Name="Microsoft\|RDV Integration Component Resource Pool\|V2.0"; ResultCode = 0x80041010; PossibleCause = Unknown	5858	2	4611686018427387904	483	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	976	2692	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:41:30 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3176; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll	5857	0	4611686018427387904	482	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	3176	1548	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 9:40:26 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3952; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\interop\ms_409 : MSFTSM_RegisteredSubprofile; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	481	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	4728	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:38:50 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3952; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\interop\ms_409 : MSFTSM_SubProfileRequiresProfile; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	480	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	4728	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:38:50 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3952; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\interop\ms_409 : MSFTSM_RegisteredProfile; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	479	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	4728	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:38:50 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3952; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\interop\ms_409 : MSFTSM_ReferencedProfile; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	478	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	4728	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:38:50 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3952; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\interop\ms_409 : MSFTSM_ElementSoftwareIdentity; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	477	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	4728	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:38:50 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3952; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\interop\ms_409 : MSFTSM_ElementConformsToProfileEx; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	476	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	4728	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:38:50 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3952; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\interop\ms_409 : MSFTSM_ElementConformsToProfile; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	475	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	4728	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:38:50 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3952; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\cimv2\storage\ms_409 : __Namespace.Name='iscsitarget'; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	474	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	4728	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:38:50 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WMIProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3968; ProviderPath = %systemroot%\system32\wbem\wmiprov.dll	5857	0	4611686018427387904	473	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	3968	4084	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:38:50 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
MSVDS__PROVIDER provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2712; ProviderPath = %systemroot%\system32\wbem\vdswmi.dll	5857	0	4611686018427387904	472	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2712	592	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 9:38:50 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2712; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll	5857	0	4611686018427387904	471	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2712	592	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 9:38:49 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
nettcpip provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4348; ProviderPath = %systemroot%\system32\wbem\NetTCPIP.dll	5857	0	4611686018427387904	470	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	4348	2924	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 9:35:55 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NetAdapterCim provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4444; ProviderPath = %systemroot%\system32\wbem\NetAdapterCim.dll	5857	0	4611686018427387904	469	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	4444	4516	WIN-5T344G8GM1H	S-1-5-19	1/19/2018 9:35:55 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4348; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll	5857	0	4611686018427387904	468	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	4348	4632	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 9:35:55 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
MSVDS__PROVIDER provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4348; ProviderPath = %systemroot%\system32\wbem\vdswmi.dll	5857	0	4611686018427387904	467	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	4348	4632	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 9:35:41 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4348; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll	5857	0	4611686018427387904	466	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	4348	4632	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 9:35:41 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
nettcpip provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4824; ProviderPath = %systemroot%\system32\wbem\NetTCPIP.dll	5857	0	4611686018427387904	465	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	4824	1600	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 9:34:04 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NetAdapterCim provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1548; ProviderPath = %systemroot%\system32\wbem\NetAdapterCim.dll	5857	0	4611686018427387904	464	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	1548	2160	WIN-5T344G8GM1H	S-1-5-19	1/19/2018 9:34:04 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4824; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll	5857	0	4611686018427387904	463	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	4824	1600	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 9:34:04 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4824; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll	5857	0	4611686018427387904	462	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	4824	4808	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 9:34:04 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 764; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll	5857	0	4611686018427387904	461	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	764	1020	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:33:46 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
MSVDS__PROVIDER provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4824; ProviderPath = %systemroot%\system32\wbem\vdswmi.dll	5857	0	4611686018427387904	460	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	4824	4808	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 9:32:20 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4824; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll	5857	0	4611686018427387904	459	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	4824	4808	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 9:32:20 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WMIProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3968; ProviderPath = %systemroot%\system32\wbem\wmiprov.dll	5857	0	4611686018427387904	458	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	3968	4084	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:31:16 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
MSVDS__PROVIDER provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1520; ProviderPath = %systemroot%\system32\wbem\vdswmi.dll	5857	0	4611686018427387904	457	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	1520	2704	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 9:29:44 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1520; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll	5857	0	4611686018427387904	456	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	1520	2704	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 9:29:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {4693033F-66F0-46C4-8E27-99621765768B}; ClientMachine = WIN-5T344G8GM1H; User = WIN-5T344G8GM1H\Administrator; ClientProcessId = 4124; Component = Core; Operation = Start IWbemServices::ExecMethod - root\microsoft\windows\servermanager : MSFT_ServerManagerTasks::GetServerFeature; ResultCode = 0x800706BE; PossibleCause = Could not send status to client	5858	2	4611686018427387904	455	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2716	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:32 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {4693033F-66F0-46C4-8E27-99621765768B}; ClientMachine = WIN-5T344G8GM1H; User = WIN-5T344G8GM1H\Administrator; ClientProcessId = 4124; Component = Unknown; Operation = Start IWbemServices::ExecMethod - root\microsoft\windows\servermanager : MSFT_ServerManagerTasks::GetServerFeature; ResultCode = 0x80041032; PossibleCause = Unknown	5858	2	4611686018427387904	454	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	432	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:32 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4608; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll	5857	0	4611686018427387904	453	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	4608	4636	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:30 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
nettcpip provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2872; ProviderPath = %systemroot%\system32\wbem\NetTCPIP.dll	5857	0	4611686018427387904	452	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2872	2896	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 9:27:26 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NetAdapterCim provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4344; ProviderPath = %systemroot%\system32\wbem\NetAdapterCim.dll	5857	0	4611686018427387904	451	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	4344	4368	WIN-5T344G8GM1H	S-1-5-19	1/19/2018 9:27:26 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2872; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll	5857	0	4611686018427387904	450	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2872	2900	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 9:27:25 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
MSVDS__PROVIDER provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2872; ProviderPath = %systemroot%\system32\wbem\vdswmi.dll	5857	0	4611686018427387904	449	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2872	2900	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 9:27:20 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32a provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2872; ProviderPath = %systemroot%\system32\wbem\wmipcima.dll	5857	0	4611686018427387904	448	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2872	2900	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 9:27:19 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Namespace = //./root/CIMV2; NotificationQuery = select * from MSFT_SCMEventLogEvent; OwnerName = S-1-5-32-544; HostProcessID = 956; Provider= SCM Event Provider, queryID = 0; PossibleCause = Permanent	5859	0	4611686018427387904	447	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2284	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:18 AM	aff0bd57-9107-0002-9bbd-f0af0791d301	microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Namespace = root\virtualization\v2; NotificationQuery = SELECT * FROM __ClassOperationEvent; UserName = .\SYSTEM; ClientProcessID = 0, ClientMachine = ; PossibleCause = Temporary	5860	0	4611686018427387904	446	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:18 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Namespace = //./root/subscription; Eventfilter = SCM Event Log Filter (refer to its activate eventid:5859); Consumer = NTEventLogEventConsumer="SCM Event Log Consumer"; PossibleCause = Binding EventFilter: instance of __EventFilter { CreatorSID = {1, 2, 0, 0, 0, 0, 0, 5, 32, 0, 0, 0, 32, 2, 0, 0}; EventNamespace = "root\\cimv2"; Name = "SCM Event Log Filter"; Query = "select * from MSFT_SCMEventLogEvent"; QueryLanguage = "WQL"; }; Perm. Consumer: instance of NTEventLogEventConsumer { Category = 0; CreatorSID = {1, 2, 0, 0, 0, 0, 0, 5, 32, 0, 0, 0, 32, 2, 0, 0}; EventType = 1; Name = "SCM Event Log Consumer"; NameOfUserSIDProperty = "sid"; SourceName = "Service Control Manager"; };	5861	0	4611686018427387904	445	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2284	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:18 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{FC491EF1-C4AA-4CE1-B329-414B101DB823}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	444	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{fbf687e6-f063-4d9f-9f4f-fd9a26acdd5f}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	443	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{FB2CA36D-0B40-4307-821B-A13B252DE56C}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	442	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{f3ccc681-b74c-4060-9f26-cd84525dca2a}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	441	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{F312195E-3D9D-447A-A3F5-08DFFA24735E}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	440	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{E62688F0-25FD-4c90-BFF5-F508B9D2E31F}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	439	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{E5094040-C46C-4115-B030-04FB2E545B00}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	438	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{E4F48E54-F38D-4884-BFB9-D4D2E5729C18}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	437	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{e437bc1c-aa7d-11d2-a382-00c04f991e27}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	436	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{CF7639F3-ABA2-41DB-97F2-81E2C5DBFC5D}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	435	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{cdeafc3d-948d-49dd-ab12-e578ba4af7aa}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	434	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{c6dc5466-785a-11d2-84d0-00c04fb169f7}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	433	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{C631DF4C-088F-4156-B058-4375F0853CD8}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	432	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{C418DD9D-0D14-4efb-8FBF-CFE535C8FAC7}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	431	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{C34B2751-1CF4-44F5-9262-C3FC39666591}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	430	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{BC75B1ED-5833-4858-9BB8-CBF0B166DF9D}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	429	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{BA649533-0AAC-4E04-B9BC-4DBAE0325B12}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	428	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{B587E2B1-4D59-4e7e-AED9-22B9DF11D053}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	427	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{B087BE9D-ED37-454f-AF9C-04291E351182}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	426	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{AADCED64-746C-4633-A97C-D61349046527}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	425	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{A3F3E39B-5D83-4940-B954-28315B82F0A8}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	424	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{91FBB303-0CD5-4055-BF42-E512A681B325}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	423	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{8A28E2C5-8D06-49A4-A08C-632DAA493E17}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	422	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{827D319E-6EAC-11D2-A4EA-00C04F79F83A}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	421	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{7B849a69-220F-451E-B3FE-2CB811AF94AE}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	420	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2864	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{7933F41E-56F8-41d6-A31C-4148A711EE93}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	419	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2864	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{74EE6C03-5363-4554-B161-627540339CAB}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	418	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2864	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{728EE579-943C-4519-9EF7-AB56765798ED}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	417	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2864	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{7150F9BF-48AD-4da4-A49C-29EF4A8369BA}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	416	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2864	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{6A4C88C6-C502-4f74-8F60-2CB23EDC24E2}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	415	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2864	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{6232C319-91AC-4931-9385-E70C2B099F0E}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	414	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2864	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{4CFB60C1-FAA6-47f1-89AA-0B18730C9FD3}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	413	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2868	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{4bcd6cde-777b-48b6-9804-43568e23545d}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	412	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{4B7C3B0F-E993-4E06-A241-3FBE06943684}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	411	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{42B5FAAE-6536-11d2-AE5A-0000F87571E3}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	410	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2864	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{426031c0-0b47-4852-b0ca-ac3d37bfcb39}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	409	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2864	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{3A0DBA37-F8B2-4356-83DE-3E90BD5C261F}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	408	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2864	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{3610eda5-77ef-11d2-8dc5-00c04fa31a66}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	407	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2864	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{2BFCC077-22D2-48DE-BDE1-2F618D9B476D}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	406	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2864	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{2A8FDC61-2347-4C87-92F6-B05EB91A201A}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	405	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2868	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{1A6364EB-776B-4120-ADE1-B63A406A76B5}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	404	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2864	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{17D89FEC-5C44-4972-B12D-241CAEF74509}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	403	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2864	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{16be69fa-4209-4250-88cb-716cf41954e0}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	402	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2864	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{169EBF44-942F-4C43-87CE-13C93996EBBE}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	401	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{0E28E245-9368-4853-AD84-6DA3BA35BB75}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	400	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{0ACDD40C-75AC-47ab-BAA0-BF6DE7E7FE63}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	399	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{FC491EF1-C4AA-4CE1-B329-414B101DB823}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	398	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{fbf687e6-f063-4d9f-9f4f-fd9a26acdd5f}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	397	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{FB2CA36D-0B40-4307-821B-A13B252DE56C}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	396	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{f3ccc681-b74c-4060-9f26-cd84525dca2a}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	395	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{F312195E-3D9D-447A-A3F5-08DFFA24735E}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	394	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{E62688F0-25FD-4c90-BFF5-F508B9D2E31F}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	393	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{E5094040-C46C-4115-B030-04FB2E545B00}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	392	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{E4F48E54-F38D-4884-BFB9-D4D2E5729C18}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	391	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{e437bc1c-aa7d-11d2-a382-00c04f991e27}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	390	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{CF7639F3-ABA2-41DB-97F2-81E2C5DBFC5D}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	389	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{cdeafc3d-948d-49dd-ab12-e578ba4af7aa}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	388	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{c6dc5466-785a-11d2-84d0-00c04fb169f7}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	387	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{C631DF4C-088F-4156-B058-4375F0853CD8}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	386	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{C418DD9D-0D14-4efb-8FBF-CFE535C8FAC7}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	385	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{C34B2751-1CF4-44F5-9262-C3FC39666591}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	384	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{BC75B1ED-5833-4858-9BB8-CBF0B166DF9D}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	383	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{BA649533-0AAC-4E04-B9BC-4DBAE0325B12}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	382	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{B587E2B1-4D59-4e7e-AED9-22B9DF11D053}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	381	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{B087BE9D-ED37-454f-AF9C-04291E351182}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	380	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{AADCED64-746C-4633-A97C-D61349046527}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	379	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{A3F3E39B-5D83-4940-B954-28315B82F0A8}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	378	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{91FBB303-0CD5-4055-BF42-E512A681B325}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	377	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{8A28E2C5-8D06-49A4-A08C-632DAA493E17}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	376	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{827D319E-6EAC-11D2-A4EA-00C04F79F83A}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	375	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{7B849a69-220F-451E-B3FE-2CB811AF94AE}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	374	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{7933F41E-56F8-41d6-A31C-4148A711EE93}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	373	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{74EE6C03-5363-4554-B161-627540339CAB}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	372	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{728EE579-943C-4519-9EF7-AB56765798ED}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	371	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{7150F9BF-48AD-4da4-A49C-29EF4A8369BA}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	370	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{6A4C88C6-C502-4f74-8F60-2CB23EDC24E2}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	369	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{6232C319-91AC-4931-9385-E70C2B099F0E}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	368	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{4CFB60C1-FAA6-47f1-89AA-0B18730C9FD3}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	367	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{4bcd6cde-777b-48b6-9804-43568e23545d}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	366	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{4B7C3B0F-E993-4E06-A241-3FBE06943684}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	365	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{42B5FAAE-6536-11d2-AE5A-0000F87571E3}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	364	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{426031c0-0b47-4852-b0ca-ac3d37bfcb39}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	363	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{3A0DBA37-F8B2-4356-83DE-3E90BD5C261F}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	362	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{3610eda5-77ef-11d2-8dc5-00c04fa31a66}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	361	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{2BFCC077-22D2-48DE-BDE1-2F618D9B476D}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	360	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{2A8FDC61-2347-4C87-92F6-B05EB91A201A}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	359	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{1A6364EB-776B-4120-ADE1-B63A406A76B5}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	358	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{17D89FEC-5C44-4972-B12D-241CAEF74509}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	357	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{16be69fa-4209-4250-88cb-716cf41954e0}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	356	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{169EBF44-942F-4C43-87CE-13C93996EBBE}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	355	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{0E28E245-9368-4853-AD84-6DA3BA35BB75}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	354	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{0ACDD40C-75AC-47ab-BAA0-BF6DE7E7FE63}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	353	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2872; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll	5857	0	4611686018427387904	352	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2872	2900	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 2336; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\virtualization\v2 : Msvm_ResourcePoolComponent.Name="Microsoft\|RDV Integration Component Resource Pool\|V2.0"; ResultCode = 0x80041010; PossibleCause = Unknown	5858	2	4611686018427387904	351	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2864	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Namespace = ROOT\virtualization\v2; NotificationQuery = SELECT * FROM __ClassOperationEvent; UserName = .\SYSTEM; ClientProcessID = 0, ClientMachine = ; PossibleCause = Temporary	5860	0	4611686018427387904	350	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	968	2820	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:26:58 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 2360; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\virtualization\v2 : Msvm_ResourcePoolComponent.Name="Microsoft\|RDV Integration Component Resource Pool\|V2.0"; ResultCode = 0x80041010; PossibleCause = Unknown	5858	2	4611686018427387904	349	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	968	2820	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:26:52 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\HyperVCluster\v2 : Msvm_VirtualHardDiskState; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	348	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	968	2820	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:26:51 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\HyperVCluster\v2 : Msvm_VirtualHardDiskSettingData; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	347	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	968	2820	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:26:51 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\HyperVCluster\v2 : Msvm_VirtualHardDiskInfo; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	346	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	968	2820	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:26:51 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\HyperVCluster\v2 : Msvm_ServicingSettings; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	345	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	968	2820	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:26:51 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\HyperVCluster\v2 : CIM_SettingsDefineState; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	344	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	968	2820	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:26:51 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\HyperVCluster\v2 : CIM_ServiceAffectsElement; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	343	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	968	2820	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:26:51 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\HyperVCluster\v2 : CIM_ManagedElement; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	342	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	968	2820	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:26:51 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\HyperVCluster\v2 : CIM_ElementSettingData; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	341	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	968	2820	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:26:51 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\HyperVCluster\v2 : CIM_ElementCapabilities; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	340	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	968	2820	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:26:51 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\HyperVCluster\v2 : CIM_Dependency; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	339	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	968	2820	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:26:51 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\HyperVCluster\v2 : CIM_Component; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	338	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	968	2820	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:26:51 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\HyperVCluster\v2 : CIM_AffectedJobElement; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	337	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	968	2820	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:26:51 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\HyperVCluster\v2\ms_409 : Msvm_SummaryInformationBase; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	336	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	968	2820	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:26:51 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\HyperVCluster\v2\ms_409 : CIM_SettingsDefineState; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	335	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	968	2820	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:26:51 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\HyperVCluster\v2\ms_409 : CIM_ServiceAffectsElement; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	334	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	968	2824	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:26:51 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\HyperVCluster\v2\ms_409 : CIM_ManagedElement; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	333	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	968	2820	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:26:51 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\HyperVCluster\v2\ms_409 : CIM_ElementSettingData; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	332	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	968	2820	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:26:51 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\HyperVCluster\v2\ms_409 : CIM_ElementCapabilities; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	331	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	968	2820	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:26:51 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\HyperVCluster\v2\ms_409 : CIM_Dependency; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	330	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	968	2820	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:26:51 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\HyperVCluster\v2\ms_409 : CIM_Component; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	329	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	968	2820	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:26:51 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\HyperVCluster\v2\ms_409 : CIM_AffectedJobElement; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	328	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	968	2820	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:26:51 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Namespace = //./root/CIMV2; NotificationQuery = select * from MSFT_SCMEventLogEvent; OwnerName = S-1-5-32-544; HostProcessID = 968; Provider= SCM Event Provider, queryID = 0; PossibleCause = Permanent	5859	0	4611686018427387904	327	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	968	2948	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:26:51 AM	96ed06e7-9107-0000-3d07-ed960791d301	microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Namespace = //./root/subscription; Eventfilter = SCM Event Log Filter (refer to its activate eventid:5859); Consumer = NTEventLogEventConsumer="SCM Event Log Consumer"; PossibleCause = Binding EventFilter: instance of __EventFilter { CreatorSID = {1, 2, 0, 0, 0, 0, 0, 5, 32, 0, 0, 0, 32, 2, 0, 0}; EventNamespace = "root\\cimv2"; Name = "SCM Event Log Filter"; Query = "select * from MSFT_SCMEventLogEvent"; QueryLanguage = "WQL"; }; Perm. Consumer: instance of NTEventLogEventConsumer { Category = 0; CreatorSID = {1, 2, 0, 0, 0, 0, 0, 5, 32, 0, 0, 0, 32, 2, 0, 0}; EventType = 1; Name = "SCM Event Log Consumer"; NameOfUserSIDProperty = "sid"; SourceName = "Service Control Manager"; };	5861	0	4611686018427387904	326	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	968	2948	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:26:51 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2 : Msvm_VirtualDiskChangedRange; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	325	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	968	2820	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:26:50 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2 : Msvm_VHDSSnapshotInformation; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	324	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	968	2820	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:26:50 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2 : Msvm_VHDSetInformation; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	323	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	968	2820	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:26:50 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2 : Msvm_VirtualHardDiskSettingData; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	322	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	968	2820	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:26:50 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2 : Msvm_VirtualHardDiskInfo; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	321	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	968	2820	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:26:50 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2 : Msvm_SummaryInformationBase; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	320	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	968	2820	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:26:50 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2 : Msvm_ServicingSettings; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	319	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	968	2820	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:26:50 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2 : CIM_SettingsDefineState; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	318	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	968	2820	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:26:50 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2 : CIM_ServiceAffectsElement; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	317	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	968	2820	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:26:50 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2 : CIM_ManagedElement; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	316	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	968	2820	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:26:50 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2 : CIM_ElementSettingData; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	315	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	968	2820	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:26:50 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2 : CIM_ElementCapabilities; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	314	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	968	2820	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:26:50 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2 : CIM_Dependency; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	313	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	968	2820	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:26:50 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2 : CIM_Component; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	312	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	968	2820	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:26:50 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2 : CIM_AffectedJobElement; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	311	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	968	2820	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:26:50 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2\ms_409 : Msvm_VirtualDiskChangedRange; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	310	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	968	2820	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:26:49 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2\ms_409 : Msvm_VHDSSnapshotInformation; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	309	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	968	2820	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:26:49 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2\ms_409 : Msvm_VHDSetInformation; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	308	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	968	2820	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:26:49 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2\ms_409 : Msvm_VirtualHardDiskSettingData; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	307	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	968	2820	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:26:49 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2\ms_409 : Msvm_VirtualHardDiskInfo; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	306	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	968	2820	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:26:49 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2\ms_409 : Msvm_SummaryInformationBase; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	305	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	968	2820	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:26:49 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2\ms_409 : Msvm_ServicingSettings; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	304	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	968	2820	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:26:49 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2\ms_409 : CIM_SettingsDefineState; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	303	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	968	2820	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:26:49 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2\ms_409 : CIM_ServiceAffectsElement; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	302	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	968	2820	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:26:49 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2\ms_409 : CIM_ManagedElement; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	301	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	968	2820	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:26:49 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2\ms_409 : CIM_ElementSettingData; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	300	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	968	2820	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:26:49 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2\ms_409 : CIM_ElementCapabilities; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	299	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	968	2820	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:26:49 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2\ms_409 : CIM_Dependency; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	298	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	968	2820	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:26:49 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2\ms_409 : CIM_Component; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	297	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	968	2820	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:26:49 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2\ms_409 : CIM_AffectedJobElement; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	296	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	968	2820	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:26:49 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
MSVDS__PROVIDER provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2840; ProviderPath = %systemroot%\system32\wbem\vdswmi.dll	5857	0	4611686018427387904	295	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2840	2880	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 9:26:46 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32a provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2840; ProviderPath = %systemroot%\system32\wbem\wmipcima.dll	5857	0	4611686018427387904	294	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2840	2880	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 9:26:44 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2840; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll	5857	0	4611686018427387904	293	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2840	2864	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 9:26:42 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 308; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_ComputerSystem; ResultCode = 0x80041032; PossibleCause = Unknown	5858	2	4611686018427387904	292	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2620	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:25:03 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 308; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_ComputerSystem; ResultCode = 0x80041032; PossibleCause = Unknown	5858	2	4611686018427387904	291	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	404	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:25:02 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2528; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll	5857	0	4611686018427387904	290	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2528	3456	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:24:56 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
nettcpip provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2508; ProviderPath = %systemroot%\system32\wbem\NetTCPIP.dll	5857	0	4611686018427387904	289	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2508	4092	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 9:24:53 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NetAdapterCim provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2736; ProviderPath = %systemroot%\system32\wbem\NetAdapterCim.dll	5857	0	4611686018427387904	288	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2736	3804	WIN-5T344G8GM1H	S-1-5-19	1/19/2018 9:24:53 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2508; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll	5857	0	4611686018427387904	287	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2508	4092	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 9:24:53 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2508; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll	5857	0	4611686018427387904	286	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2508	2824	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 9:24:53 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3200; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll	5857	0	4611686018427387904	285	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	3200	3644	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:23:15 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
nettcpip provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2856; ProviderPath = %systemroot%\system32\wbem\NetTCPIP.dll	5857	0	4611686018427387904	284	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2856	2920	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 9:23:12 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NetAdapterCim provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2540; ProviderPath = %systemroot%\system32\wbem\NetAdapterCim.dll	5857	0	4611686018427387904	283	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2540	3240	WIN-5T344G8GM1H	S-1-5-19	1/19/2018 9:23:12 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2856; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll	5857	0	4611686018427387904	282	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2856	2884	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 9:23:11 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
MSVDS__PROVIDER provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2856; ProviderPath = %systemroot%\system32\wbem\vdswmi.dll	5857	0	4611686018427387904	281	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2856	2884	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 9:23:05 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32a provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2856; ProviderPath = %systemroot%\system32\wbem\wmipcima.dll	5857	0	4611686018427387904	280	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2856	2884	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 9:23:04 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Namespace = //./root/CIMV2; NotificationQuery = select * from MSFT_SCMEventLogEvent; OwnerName = S-1-5-32-544; HostProcessID = 956; Provider= SCM Event Provider, queryID = 0; PossibleCause = Permanent	5859	0	4611686018427387904	279	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2916	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:23:03 AM	17f2f0cc-9107-0002-12f1-f2170791d301	microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Namespace = //./root/subscription; Eventfilter = SCM Event Log Filter (refer to its activate eventid:5859); Consumer = NTEventLogEventConsumer="SCM Event Log Consumer"; PossibleCause = Binding EventFilter: instance of __EventFilter { CreatorSID = {1, 2, 0, 0, 0, 0, 0, 5, 32, 0, 0, 0, 32, 2, 0, 0}; EventNamespace = "root\\cimv2"; Name = "SCM Event Log Filter"; Query = "select * from MSFT_SCMEventLogEvent"; QueryLanguage = "WQL"; }; Perm. Consumer: instance of NTEventLogEventConsumer { Category = 0; CreatorSID = {1, 2, 0, 0, 0, 0, 0, 5, 32, 0, 0, 0, 32, 2, 0, 0}; EventType = 1; Name = "SCM Event Log Consumer"; NameOfUserSIDProperty = "sid"; SourceName = "Service Control Manager"; };	5861	0	4611686018427387904	278	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	956	2908	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:23:03 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2856; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll	5857	0	4611686018427387904	277	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2856	2884	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 9:23:02 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3808; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll	5857	0	4611686018427387904	276	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	3808	4032	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:14:59 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
nettcpip provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2664; ProviderPath = %systemroot%\system32\wbem\NetTCPIP.dll	5857	0	4611686018427387904	275	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2664	2720	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 9:14:58 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NetAdapterCim provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2972; ProviderPath = %systemroot%\system32\wbem\NetAdapterCim.dll	5857	0	4611686018427387904	274	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2972	156	WIN-5T344G8GM1H	S-1-5-19	1/19/2018 9:14:58 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2664; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll	5857	0	4611686018427387904	273	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2664	2720	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 9:14:57 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2664; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll	5857	0	4611686018427387904	272	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2664	1584	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 9:14:57 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = WIN-5T344G8GM1H\Administrator; ClientProcessId = 1860; Component = Unknown; Operation = Start IWbemServices::PutInstance - root\cimv2 : Win32_ComputerSystem.Name="WIN-5T344G8GM1H"; ResultCode = 0x80041001; PossibleCause = Unknown	5858	2	4611686018427387904	271	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	1180	4136	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:11:39 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4368; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll	5857	0	4611686018427387904	270	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	4368	4496	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 9:10:55 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1784; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll	5857	0	4611686018427387904	269	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	1784	2240	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:05:00 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
nettcpip provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 952; ProviderPath = %systemroot%\system32\wbem\NetTCPIP.dll	5857	0	4611686018427387904	268	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	952	452	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 9:04:58 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NetAdapterCim provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1152; ProviderPath = %systemroot%\system32\wbem\NetAdapterCim.dll	5857	0	4611686018427387904	267	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	1152	1396	WIN-5T344G8GM1H	S-1-5-19	1/19/2018 9:04:58 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 952; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll	5857	0	4611686018427387904	266	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	952	452	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 9:04:57 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 952; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll	5857	0	4611686018427387904	265	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	952	1000	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 9:04:57 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WMIProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3176; ProviderPath = %systemroot%\system32\wbem\wmiprov.dll	5857	0	4611686018427387904	264	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	3176	3364	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:58:49 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
MSVDS__PROVIDER provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4672; ProviderPath = %systemroot%\system32\wbem\vdswmi.dll	5857	0	4611686018427387904	263	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	4672	4700	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 8:57:50 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4672; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll	5857	0	4611686018427387904	262	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	4672	4700	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 8:57:50 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 88; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_ComputerSystemProduct; ResultCode = 0x80041032; PossibleCause = Unknown	5858	2	4611686018427387904	261	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	1180	1284	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:56:50 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4672; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll	5857	0	4611686018427387904	260	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	4672	4700	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 8:56:50 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Namespace = //./root/CIMV2; NotificationQuery = select * from MSFT_SCMEventLogEvent; OwnerName = S-1-5-32-544; HostProcessID = 1180; Provider= SCM Event Provider, queryID = 0; PossibleCause = Permanent	5859	0	4611686018427387904	259	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	1180	4340	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:56:46 AM	289cfce6-9103-0003-f9fd-9c280391d301	microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Namespace = //./root/subscription; Eventfilter = SCM Event Log Filter (refer to its activate eventid:5859); Consumer = NTEventLogEventConsumer="SCM Event Log Consumer"; PossibleCause = Binding EventFilter: instance of __EventFilter { CreatorSID = {1, 2, 0, 0, 0, 0, 0, 5, 32, 0, 0, 0, 32, 2, 0, 0}; EventNamespace = "root\\cimv2"; Name = "SCM Event Log Filter"; Query = "select * from MSFT_SCMEventLogEvent"; QueryLanguage = "WQL"; }; Perm. Consumer: instance of NTEventLogEventConsumer { Category = 0; CreatorSID = {1, 2, 0, 0, 0, 0, 0, 5, 32, 0, 0, 0, 32, 2, 0, 0}; EventType = 1; Name = "SCM Event Log Consumer"; NameOfUserSIDProperty = "sid"; SourceName = "Service Control Manager"; };	5861	0	4611686018427387904	258	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	1180	4340	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:56:46 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
MSVDS__PROVIDER provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3968; ProviderPath = %systemroot%\system32\wbem\vdswmi.dll	5857	0	4611686018427387904	257	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	3968	4008	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 8:55:06 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32a provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3968; ProviderPath = %systemroot%\system32\wbem\wmipcima.dll	5857	0	4611686018427387904	256	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	3968	4008	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 8:55:05 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3688; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll	5857	0	4611686018427387904	255	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	3688	3696	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:55:04 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
nettcpip provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3968; ProviderPath = %systemroot%\system32\wbem\NetTCPIP.dll	5857	0	4611686018427387904	254	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	3968	4020	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 8:54:58 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NetAdapterCim provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4024; ProviderPath = %systemroot%\system32\wbem\NetAdapterCim.dll	5857	0	4611686018427387904	253	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	4024	4052	WIN-5T344G8GM1H	S-1-5-19	1/19/2018 8:54:58 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3968; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll	5857	0	4611686018427387904	252	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	3968	4008	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 8:54:58 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3968; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll	5857	0	4611686018427387904	251	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	3968	3996	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 8:54:58 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3880; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll	5857	0	4611686018427387904	250	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	3880	3916	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 8:54:38 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {7C5C4FFB-9102-0000-4A51-5C7C0291D301}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 1192; Component = Unknown; Operation = Start IWbemServices::ExecNotificationQuery - ROOT\CIMV2 : SELECT * FROM Win32_ProcessStartTrace WHERE ProcessName = 'wsmprovhost.exe'; ResultCode = 0x80041032; PossibleCause = Unknown	5858	2	4611686018427387904	249	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	1192	3004	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:54:34 AM	7c5c4ffb-9102-0000-4a51-5c7c0291d301	microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WMIProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1200; ProviderPath = %systemroot%\system32\wbem\wmiprov.dll	5857	0	4611686018427387904	248	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	1200	2840	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:54:03 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Namespace = ROOT\CIMV2; NotificationQuery = SELECT * FROM Win32_ProcessStartTrace WHERE ProcessName = 'wsmprovhost.exe'; UserName = ; ClientProcessID = 1192, ClientMachine = WIN-5T344G8GM1H; PossibleCause = Temporary	5860	0	4611686018427387904	247	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	1192	2792	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:52:27 AM	7c5c4ffb-9102-0001-8851-5c7c0291d301	microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WMI Kernel Trace Event Provider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1192; ProviderPath = C:\Windows\System32\wbem\krnlprov.dll	5857	0	4611686018427387904	246	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	1192	2792	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:52:27 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Namespace = //./root/CIMV2; NotificationQuery = select * from MSFT_SCMEventLogEvent; OwnerName = S-1-5-32-544; HostProcessID = 1192; Provider= SCM Event Provider, queryID = 0; PossibleCause = Permanent	5859	0	4611686018427387904	245	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	1192	2796	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:51:57 AM	7c5c4ffb-9102-0001-5f51-5c7c0291d301	microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Namespace = //./root/subscription; Eventfilter = SCM Event Log Filter (refer to its activate eventid:5859); Consumer = NTEventLogEventConsumer="SCM Event Log Consumer"; PossibleCause = Binding EventFilter: instance of __EventFilter { CreatorSID = {1, 2, 0, 0, 0, 0, 0, 5, 32, 0, 0, 0, 32, 2, 0, 0}; EventNamespace = "root\\cimv2"; Name = "SCM Event Log Filter"; Query = "select * from MSFT_SCMEventLogEvent"; QueryLanguage = "WQL"; }; Perm. Consumer: instance of NTEventLogEventConsumer { Category = 0; CreatorSID = {1, 2, 0, 0, 0, 0, 0, 5, 32, 0, 0, 0, 32, 2, 0, 0}; EventType = 1; Name = "SCM Event Log Consumer"; NameOfUserSIDProperty = "sid"; SourceName = "Service Control Manager"; };	5861	0	4611686018427387904	244	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	1192	2796	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:51:57 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
MSVDS__PROVIDER provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3832; ProviderPath = %systemroot%\system32\wbem\vdswmi.dll	5857	0	4611686018427387904	243	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	3832	3932	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 8:51:38 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32a provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3832; ProviderPath = %systemroot%\system32\wbem\wmipcima.dll	5857	0	4611686018427387904	242	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	3832	3872	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 8:51:37 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 428; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll	5857	0	4611686018427387904	241	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	428	1316	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:51:13 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
nettcpip provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3832; ProviderPath = %systemroot%\system32\wbem\NetTCPIP.dll	5857	0	4611686018427387904	240	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	3832	3872	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 8:51:04 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NetAdapterCim provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3888; ProviderPath = %systemroot%\system32\wbem\NetAdapterCim.dll	5857	0	4611686018427387904	239	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	3888	3916	WIN-5T344G8GM1H	S-1-5-19	1/19/2018 8:51:04 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3832; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll	5857	0	4611686018427387904	238	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	3832	3872	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 8:51:04 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3832; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll	5857	0	4611686018427387904	237	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	3832	3860	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 8:51:04 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4796; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll	5857	0	4611686018427387904	236	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	4796	840	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 8:45:55 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2284; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll	5857	0	4611686018427387904	235	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2284	2676	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:44:15 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
nettcpip provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2548; ProviderPath = %systemroot%\system32\wbem\NetTCPIP.dll	5857	0	4611686018427387904	234	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2548	2728	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 8:44:08 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NetAdapterCim provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2300; ProviderPath = %systemroot%\system32\wbem\NetAdapterCim.dll	5857	0	4611686018427387904	233	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2300	4360	WIN-5T344G8GM1H	S-1-5-19	1/19/2018 8:44:08 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2548; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll	5857	0	4611686018427387904	232	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2548	2728	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 8:44:08 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2548; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll	5857	0	4611686018427387904	231	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2548	3736	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 8:44:08 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1052; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll	5857	0	4611686018427387904	230	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	1052	4868	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 8:36:56 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3184; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll	5857	0	4611686018427387904	229	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	3184	404	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:34:15 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Win32_WIN32_TERMINALSERVICE_Prov provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1164; ProviderPath = %SystemRoot%\system32\tscfgwmi.dll	5857	0	4611686018427387904	228	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	1164	4616	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 8:34:14 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4600; Component = Unknown; Operation = Start IWbemServices::ExecQuery - ROOT\WMI : SELECT * FROM BatteryStaticData; ResultCode = 0x80041010; PossibleCause = Unknown	5858	2	4611686018427387904	227	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	964	4904	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:34:14 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4600; Component = Unknown; Operation = Start IWbemServices::ExecQuery - ROOT\WMI : SELECT * FROM BatteryFullChargedCapacity; ResultCode = 0x80041010; PossibleCause = Unknown	5858	2	4611686018427387904	226	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	964	4904	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:34:13 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
PowerWmiProvider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1164; ProviderPath = %SYSTEMROOT%\system32\PowerWmiProvider.dll	5857	0	4611686018427387904	225	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	1164	1368	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 8:34:13 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
StorageWMI provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1164; ProviderPath = %SystemRoot%\System32\storagewmi.dll	5857	0	4611686018427387904	224	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	1164	1368	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 8:34:11 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
MSVDS__PROVIDER provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1164; ProviderPath = %systemroot%\system32\wbem\vdswmi.dll	5857	0	4611686018427387904	223	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	1164	1368	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 8:34:11 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
nettcpip provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1164; ProviderPath = %systemroot%\system32\wbem\NetTCPIP.dll	5857	0	4611686018427387904	222	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	1164	1368	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 8:34:08 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NetAdapterCim provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2920; ProviderPath = %systemroot%\system32\wbem\NetAdapterCim.dll	5857	0	4611686018427387904	221	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2920	4532	WIN-5T344G8GM1H	S-1-5-19	1/19/2018 8:34:08 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1164; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll	5857	0	4611686018427387904	220	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	1164	1368	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 8:34:08 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1164; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll	5857	0	4611686018427387904	219	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	1164	1532	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 8:34:08 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9A81CB05-910F-0003-8ACC-819A0F91D301}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 964; Component = Unknown; Operation = Start IWbemServices::ExecNotificationQuery - ROOT\CIMV2 : SELECT * FROM Win32_ProcessStartTrace WHERE ProcessName = 'wsmprovhost.exe'; ResultCode = 0x80041032; PossibleCause = Unknown	5858	2	4611686018427387904	218	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	964	4228	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:33:15 AM	9a81cb05-910f-0003-8acc-819a0f91d301	microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3976; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\Microsoft\Windows\DeviceGuard : SELECT RequiredSecurityProperties FROM Win32_DeviceGuard ; ResultCode = 0x80041032; PossibleCause = Unknown	5858	2	4611686018427387904	217	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	964	1824	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:33:01 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3976; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\Microsoft\Windows\DeviceGuard : SELECT SecurityServicesConfigured FROM Win32_DeviceGuard ; ResultCode = 0x80041032; PossibleCause = Unknown	5858	2	4611686018427387904	216	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	964	5076	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:33:01 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Win32_TpmProvider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1164; ProviderPath = C:\Windows\system32\wbem\Win32_TPM.dll	5857	0	4611686018427387904	215	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	1164	1532	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 8:33:01 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3976; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\Microsoft\Windows\DeviceGuard : SELECT VirtualizationBasedSecurityStatus FROM Win32_DeviceGuard ; ResultCode = 0x80041032; PossibleCause = Unknown	5858	2	4611686018427387904	214	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	964	5076	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:33:01 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3976; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\Microsoft\Windows\DeviceGuard : SELECT SecurityServicesRunning FROM Win32_DeviceGuard ; ResultCode = 0x80041032; PossibleCause = Unknown	5858	2	4611686018427387904	213	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	964	5076	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:33:01 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3976; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\Microsoft\Windows\DeviceGuard : SELECT AvailableSecurityProperties FROM Win32_DeviceGuard ; ResultCode = 0x80041032; PossibleCause = Unknown	5858	2	4611686018427387904	212	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	964	1824	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:33:01 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3976; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\Microsoft\Windows\DeviceGuard : SELECT RequiredSecurityProperties FROM Win32_DeviceGuard ; ResultCode = 0x80041032; PossibleCause = Unknown	5858	2	4611686018427387904	211	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	964	5076	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:33:01 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Win32_DeviceGuard provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1164; ProviderPath = %SystemRoot%\System32\Win32_DeviceGuard.dll	5857	0	4611686018427387904	210	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	1164	1532	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 8:33:01 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3976; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\CIMV2 : SELECT SMBIOSAssetTag FROM Win32_SystemEnclosure ; ResultCode = 0x80041032; PossibleCause = Unknown	5858	2	4611686018427387904	209	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	964	5076	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:32:59 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
MSVDS__PROVIDER provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1164; ProviderPath = %systemroot%\system32\wbem\vdswmi.dll	5857	0	4611686018427387904	208	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	1164	1532	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 8:32:59 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1164; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll	5857	0	4611686018427387904	207	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	1164	2868	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 8:32:58 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1912; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll	5857	0	4611686018427387904	206	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	1912	3084	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:32:58 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
ServerFeatureProvider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1164; ProviderPath = %windir%\system32\wbem\servercompprov.dll	5857	0	4611686018427387904	205	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	1164	1532	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 8:32:58 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
MSVDS__PROVIDER provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 996; ProviderPath = %systemroot%\system32\wbem\vdswmi.dll	5857	0	4611686018427387904	204	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	996	456	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 8:29:00 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 996; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll	5857	0	4611686018427387904	203	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	996	456	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 8:29:00 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WMIProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4324; ProviderPath = %systemroot%\system32\wbem\wmiprov.dll	5857	0	4611686018427387904	202	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	4324	3568	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:27:56 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Namespace = ROOT\CIMV2; NotificationQuery = SELECT * FROM Win32_ProcessStartTrace WHERE ProcessName = 'wsmprovhost.exe'; UserName = ; ClientProcessID = 964, ClientMachine = WIN-5T344G8GM1H; PossibleCause = Temporary	5860	0	4611686018427387904	201	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	964	3260	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:26:55 AM	9a81cb05-910f-0000-a4cc-819a0f91d301	microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WMI Kernel Trace Event Provider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 964; ProviderPath = C:\Windows\System32\wbem\krnlprov.dll	5857	0	4611686018427387904	200	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	964	3260	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:26:55 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
MSVDS__PROVIDER provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3772; ProviderPath = %systemroot%\system32\wbem\vdswmi.dll	5857	0	4611686018427387904	199	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	3772	3768	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 8:26:50 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3772; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll	5857	0	4611686018427387904	198	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	3772	3768	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 8:25:57 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Namespace = //./root/CIMV2; NotificationQuery = select * from MSFT_SCMEventLogEvent; OwnerName = S-1-5-32-544; HostProcessID = 964; Provider= SCM Event Provider, queryID = 0; PossibleCause = Permanent	5859	0	4611686018427387904	197	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	964	4648	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:25:52 AM	9a81cb05-910f-0003-4bcc-819a0f91d301	microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Namespace = //./root/subscription; Eventfilter = SCM Event Log Filter (refer to its activate eventid:5859); Consumer = NTEventLogEventConsumer="SCM Event Log Consumer"; PossibleCause = Binding EventFilter: instance of __EventFilter { CreatorSID = {1, 2, 0, 0, 0, 0, 0, 5, 32, 0, 0, 0, 32, 2, 0, 0}; EventNamespace = "root\\cimv2"; Name = "SCM Event Log Filter"; Query = "select * from MSFT_SCMEventLogEvent"; QueryLanguage = "WQL"; }; Perm. Consumer: instance of NTEventLogEventConsumer { Category = 0; CreatorSID = {1, 2, 0, 0, 0, 0, 0, 5, 32, 0, 0, 0, 32, 2, 0, 0}; EventType = 1; Name = "SCM Event Log Consumer"; NameOfUserSIDProperty = "sid"; SourceName = "Service Control Manager"; };	5861	0	4611686018427387904	196	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	964	4648	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:25:52 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
MSVDS__PROVIDER provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3772; ProviderPath = %systemroot%\system32\wbem\vdswmi.dll	5857	0	4611686018427387904	195	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	3772	3768	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 8:24:46 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4124; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll	5857	0	4611686018427387904	194	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	4124	4152	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:24:15 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
nettcpip provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3772; ProviderPath = %systemroot%\system32\wbem\NetTCPIP.dll	5857	0	4611686018427387904	193	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	3772	3820	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 8:24:08 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NetAdapterCim provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3084; ProviderPath = %systemroot%\system32\wbem\NetAdapterCim.dll	5857	0	4611686018427387904	192	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	3084	3436	WIN-5T344G8GM1H	S-1-5-19	1/19/2018 8:24:08 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3772; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll	5857	0	4611686018427387904	191	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	3772	3800	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 8:24:08 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32a provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3772; ProviderPath = %systemroot%\system32\wbem\wmipcima.dll	5857	0	4611686018427387904	190	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	3772	3800	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 8:24:03 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3772; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll	5857	0	4611686018427387904	189	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	3772	3800	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 8:24:03 AM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3868; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll	5857	0	4611686018427387904	188	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	3868	3176	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 6:37:16 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
nettcpip provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2504; ProviderPath = %systemroot%\system32\wbem\NetTCPIP.dll	5857	0	4611686018427387904	187	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2504	2192	WIN-5T344G8GM1H	S-1-5-20	1/16/2018 6:37:14 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NetAdapterCim provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2788; ProviderPath = %systemroot%\system32\wbem\NetAdapterCim.dll	5857	0	4611686018427387904	186	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2788	2624	WIN-5T344G8GM1H	S-1-5-19	1/16/2018 6:37:14 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2504; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll	5857	0	4611686018427387904	185	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2504	2192	WIN-5T344G8GM1H	S-1-5-20	1/16/2018 6:37:14 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2504; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll	5857	0	4611686018427387904	184	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2504	2440	WIN-5T344G8GM1H	S-1-5-20	1/16/2018 6:37:14 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4024; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll	5857	0	4611686018427387904	183	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	4024	3868	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 6:27:16 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
nettcpip provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1288; ProviderPath = %systemroot%\system32\wbem\NetTCPIP.dll	5857	0	4611686018427387904	182	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	1288	3280	WIN-5T344G8GM1H	S-1-5-20	1/16/2018 6:27:14 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NetAdapterCim provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1500; ProviderPath = %systemroot%\system32\wbem\NetAdapterCim.dll	5857	0	4611686018427387904	181	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	1500	2664	WIN-5T344G8GM1H	S-1-5-19	1/16/2018 6:27:14 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1288; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll	5857	0	4611686018427387904	180	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	1288	3280	WIN-5T344G8GM1H	S-1-5-20	1/16/2018 6:27:14 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1288; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll	5857	0	4611686018427387904	179	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	1288	4056	WIN-5T344G8GM1H	S-1-5-20	1/16/2018 6:27:14 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 652; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll	5857	0	4611686018427387904	178	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	652	1972	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 6:17:16 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
nettcpip provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4032; ProviderPath = %systemroot%\system32\wbem\NetTCPIP.dll	5857	0	4611686018427387904	177	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	4032	3152	WIN-5T344G8GM1H	S-1-5-20	1/16/2018 6:17:14 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NetAdapterCim provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3688; ProviderPath = %systemroot%\system32\wbem\NetAdapterCim.dll	5857	0	4611686018427387904	176	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	3688	3124	WIN-5T344G8GM1H	S-1-5-19	1/16/2018 6:17:14 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4032; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll	5857	0	4611686018427387904	175	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	4032	1184	WIN-5T344G8GM1H	S-1-5-20	1/16/2018 6:17:14 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4032; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll	5857	0	4611686018427387904	174	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	4032	1160	WIN-5T344G8GM1H	S-1-5-20	1/16/2018 6:17:14 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WMIProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1088; ProviderPath = %systemroot%\system32\wbem\wmiprov.dll	5857	0	4611686018427387904	173	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	1088	4088	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 6:10:25 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2784; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll	5857	0	4611686018427387904	172	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2784	1752	WIN-5T344G8GM1H	S-1-5-20	1/16/2018 6:08:29 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Namespace = //./root/CIMV2; NotificationQuery = select * from MSFT_SCMEventLogEvent; OwnerName = S-1-5-32-544; HostProcessID = 1176; Provider= SCM Event Provider, queryID = 0; PossibleCause = Permanent	5859	0	4611686018427387904	171	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	1176	3928	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 6:08:20 PM	b65c0852-8ef4-0003-8709-5cb6f48ed301	microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Namespace = //./root/subscription; Eventfilter = SCM Event Log Filter (refer to its activate eventid:5859); Consumer = NTEventLogEventConsumer="SCM Event Log Consumer"; PossibleCause = Binding EventFilter: instance of __EventFilter { CreatorSID = {1, 2, 0, 0, 0, 0, 0, 5, 32, 0, 0, 0, 32, 2, 0, 0}; EventNamespace = "root\\cimv2"; Name = "SCM Event Log Filter"; Query = "select * from MSFT_SCMEventLogEvent"; QueryLanguage = "WQL"; }; Perm. Consumer: instance of NTEventLogEventConsumer { Category = 0; CreatorSID = {1, 2, 0, 0, 0, 0, 0, 5, 32, 0, 0, 0, 32, 2, 0, 0}; EventType = 1; Name = "SCM Event Log Consumer"; NameOfUserSIDProperty = "sid"; SourceName = "Service Control Manager"; };	5861	0	4611686018427387904	170	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	1176	3928	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 6:08:20 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
MSVDS__PROVIDER provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2784; ProviderPath = %systemroot%\system32\wbem\vdswmi.dll	5857	0	4611686018427387904	169	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2784	1752	WIN-5T344G8GM1H	S-1-5-20	1/16/2018 6:07:37 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32a provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2784; ProviderPath = %systemroot%\system32\wbem\wmipcima.dll	5857	0	4611686018427387904	168	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2784	1752	WIN-5T344G8GM1H	S-1-5-20	1/16/2018 6:07:36 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
nettcpip provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2784; ProviderPath = %systemroot%\system32\wbem\NetTCPIP.dll	5857	0	4611686018427387904	167	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2784	4072	WIN-5T344G8GM1H	S-1-5-20	1/16/2018 6:07:14 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NetAdapterCim provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4076; ProviderPath = %systemroot%\system32\wbem\NetAdapterCim.dll	5857	0	4611686018427387904	166	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	4076	1920	WIN-5T344G8GM1H	S-1-5-19	1/16/2018 6:07:14 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2784; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll	5857	0	4611686018427387904	165	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2784	4060	WIN-5T344G8GM1H	S-1-5-20	1/16/2018 6:07:14 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2784; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll	5857	0	4611686018427387904	164	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2784	2824	WIN-5T344G8GM1H	S-1-5-20	1/16/2018 6:07:14 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 2584; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\Microsoft\Windows\DeviceGuard : SELECT AvailableSecurityProperties FROM Win32_DeviceGuard ; ResultCode = 0x80041032; PossibleCause = Unknown	5858	2	4611686018427387904	163	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	1176	2580	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 6:06:34 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 2584; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\Microsoft\Windows\DeviceGuard : SELECT RequiredSecurityProperties FROM Win32_DeviceGuard ; ResultCode = 0x80041032; PossibleCause = Unknown	5858	2	4611686018427387904	162	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	1176	2580	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 6:06:34 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 2584; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\Microsoft\Windows\DeviceGuard : SELECT SecurityServicesConfigured FROM Win32_DeviceGuard ; ResultCode = 0x80041032; PossibleCause = Unknown	5858	2	4611686018427387904	161	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	1176	2640	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 6:06:34 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Win32_TpmProvider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2784; ProviderPath = C:\Windows\system32\wbem\Win32_TPM.dll	5857	0	4611686018427387904	160	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2784	2824	WIN-5T344G8GM1H	S-1-5-20	1/16/2018 6:06:34 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 2584; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\Microsoft\Windows\DeviceGuard : SELECT VirtualizationBasedSecurityStatus FROM Win32_DeviceGuard ; ResultCode = 0x80041032; PossibleCause = Unknown	5858	2	4611686018427387904	159	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	1176	2640	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 6:06:33 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 2584; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\Microsoft\Windows\DeviceGuard : SELECT SecurityServicesRunning FROM Win32_DeviceGuard ; ResultCode = 0x80041032; PossibleCause = Unknown	5858	2	4611686018427387904	158	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	1176	2580	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 6:06:33 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 2584; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\Microsoft\Windows\DeviceGuard : SELECT SecurityServicesRunning FROM Win32_DeviceGuard ; ResultCode = 0x80041032; PossibleCause = Unknown	5858	2	4611686018427387904	157	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	1176	2580	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 6:06:33 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 2584; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\Microsoft\Windows\DeviceGuard : SELECT AvailableSecurityProperties FROM Win32_DeviceGuard ; ResultCode = 0x80041032; PossibleCause = Unknown	5858	2	4611686018427387904	156	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	1176	2580	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 6:06:33 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 2584; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\Microsoft\Windows\DeviceGuard : SELECT RequiredSecurityProperties FROM Win32_DeviceGuard ; ResultCode = 0x80041032; PossibleCause = Unknown	5858	2	4611686018427387904	155	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	1176	2580	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 6:06:33 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Win32_DeviceGuard provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2784; ProviderPath = %SystemRoot%\System32\Win32_DeviceGuard.dll	5857	0	4611686018427387904	154	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2784	2824	WIN-5T344G8GM1H	S-1-5-20	1/16/2018 6:06:33 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 2584; Component = Unknown; Operation = Start IWbemServices::ExecQuery - ROOT\CIMV2 : select ChassisTypes from Win32_SystemEnclosure; ResultCode = 0x80041032; PossibleCause = Unknown	5858	2	4611686018427387904	153	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	1176	2640	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 6:06:33 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2784; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll	5857	0	4611686018427387904	152	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2784	2824	WIN-5T344G8GM1H	S-1-5-20	1/16/2018 6:06:32 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 2584; Component = Unknown; Operation = Start IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT ID FROM Win32_ServerFeature; ResultCode = 0x80041032; PossibleCause = Unknown	5858	2	4611686018427387904	151	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	1176	2640	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 6:06:32 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2832; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll	5857	0	4611686018427387904	150	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2832	2860	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 6:06:27 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
ServerFeatureProvider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2784; ProviderPath = %windir%\system32\wbem\servercompprov.dll	5857	0	4611686018427387904	149	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2784	2812	WIN-5T344G8GM1H	S-1-5-20	1/16/2018 6:06:27 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4892; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll	5857	0	4611686018427387904	148	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	4892	836	WIN-5T344G8GM1H	S-1-5-20	1/16/2018 6:02:36 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4256; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll	5857	0	4611686018427387904	147	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	4256	4144	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:53:30 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
nettcpip provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4976; ProviderPath = %systemroot%\system32\wbem\NetTCPIP.dll	5857	0	4611686018427387904	146	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	4976	3800	WIN-5T344G8GM1H	S-1-5-20	1/16/2018 5:53:24 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NetAdapterCim provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 5092; ProviderPath = %systemroot%\system32\wbem\NetAdapterCim.dll	5857	0	4611686018427387904	145	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	5092	2628	WIN-5T344G8GM1H	S-1-5-19	1/16/2018 5:53:24 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4976; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll	5857	0	4611686018427387904	144	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	4976	3800	WIN-5T344G8GM1H	S-1-5-20	1/16/2018 5:53:23 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4976; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll	5857	0	4611686018427387904	143	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	4976	5116	WIN-5T344G8GM1H	S-1-5-20	1/16/2018 5:53:23 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {53B2B737-8EF1-0000-6DB9-B253F18ED301}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 1152; Component = Unknown; Operation = Start IWbemServices::ExecNotificationQuery - ROOT\CIMV2 : SELECT * FROM Win32_ProcessStartTrace WHERE ProcessName = 'wsmprovhost.exe'; ResultCode = 0x80041032; PossibleCause = Unknown	5858	2	4611686018427387904	142	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	1152	4780	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:50:11 PM	53b2b737-8ef1-0000-6db9-b253f18ed301	microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WMIProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3688; ProviderPath = %systemroot%\system32\wbem\wmiprov.dll	5857	0	4611686018427387904	141	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	3688	2160	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:46:15 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Namespace = ROOT\CIMV2; NotificationQuery = SELECT * FROM Win32_ProcessStartTrace WHERE ProcessName = 'wsmprovhost.exe'; UserName = ; ClientProcessID = 1152, ClientMachine = WIN-5T344G8GM1H; PossibleCause = Temporary	5860	0	4611686018427387904	140	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	1152	4676	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:44:23 PM	53b2b737-8ef1-0003-feb9-b253f18ed301	microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WMI Kernel Trace Event Provider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1152; ProviderPath = C:\Windows\System32\wbem\krnlprov.dll	5857	0	4611686018427387904	139	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	1152	4676	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:44:23 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 400; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_ComputerSystemProduct; ResultCode = 0x80041032; PossibleCause = Unknown	5858	2	4611686018427387904	138	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	1152	2600	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:44:12 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4212; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll	5857	0	4611686018427387904	137	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	4212	4236	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:43:31 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
MSVDS__PROVIDER provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 976; ProviderPath = %systemroot%\system32\wbem\vdswmi.dll	5857	0	4611686018427387904	136	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	976	2796	WIN-5T344G8GM1H	S-1-5-20	1/16/2018 5:43:29 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
nettcpip provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 976; ProviderPath = %systemroot%\system32\wbem\NetTCPIP.dll	5857	0	4611686018427387904	135	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	976	3216	WIN-5T344G8GM1H	S-1-5-20	1/16/2018 5:43:23 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NetAdapterCim provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3208; ProviderPath = %systemroot%\system32\wbem\NetAdapterCim.dll	5857	0	4611686018427387904	134	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	3208	3308	WIN-5T344G8GM1H	S-1-5-19	1/16/2018 5:43:23 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 976; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll	5857	0	4611686018427387904	133	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	976	324	WIN-5T344G8GM1H	S-1-5-20	1/16/2018 5:43:23 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32a provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 976; ProviderPath = %systemroot%\system32\wbem\wmipcima.dll	5857	0	4611686018427387904	132	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	976	324	WIN-5T344G8GM1H	S-1-5-20	1/16/2018 5:43:17 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 976; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll	5857	0	4611686018427387904	131	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	976	324	WIN-5T344G8GM1H	S-1-5-20	1/16/2018 5:43:17 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Namespace = //./root/CIMV2; NotificationQuery = select * from MSFT_SCMEventLogEvent; OwnerName = S-1-5-32-544; HostProcessID = 1152; Provider= SCM Event Provider, queryID = 0; PossibleCause = Permanent	5859	0	4611686018427387904	130	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	1152	2720	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:42:38 PM	53b2b737-8ef1-0001-8eb7-b253f18ed301	microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Namespace = //./root/subscription; Eventfilter = SCM Event Log Filter (refer to its activate eventid:5859); Consumer = NTEventLogEventConsumer="SCM Event Log Consumer"; PossibleCause = Binding EventFilter: instance of __EventFilter { CreatorSID = {1, 2, 0, 0, 0, 0, 0, 5, 32, 0, 0, 0, 32, 2, 0, 0}; EventNamespace = "root\\cimv2"; Name = "SCM Event Log Filter"; Query = "select * from MSFT_SCMEventLogEvent"; QueryLanguage = "WQL"; }; Perm. Consumer: instance of NTEventLogEventConsumer { Category = 0; CreatorSID = {1, 2, 0, 0, 0, 0, 0, 5, 32, 0, 0, 0, 32, 2, 0, 0}; EventType = 1; Name = "SCM Event Log Consumer"; NameOfUserSIDProperty = "sid"; SourceName = "Service Control Manager"; };	5861	0	4611686018427387904	129	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	1152	2720	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:42:38 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {A4626349-8EA8-0003-B36D-62A4A88ED301}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::ExecNotificationQuery - ROOT\CIMV2 : SELECT * FROM Win32_ProcessStartTrace WHERE ProcessName = 'wsmprovhost.exe'; ResultCode = 0x80041032; PossibleCause = Unknown	5858	2	4611686018427387904	128	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	3696	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:37:24 PM	a4626349-8ea8-0003-b36d-62a4a88ed301	microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 164; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll	5857	0	4611686018427387904	127	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	164	3628	WIN-5T344G8GM1H	S-1-5-20	1/16/2018 5:35:48 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WmiPerfInst provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3868; ProviderPath = C:\Windows\System32\wbem\WmiPerfInst.dll	5857	0	4611686018427387904	126	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	3868	1388	WIN-5T344G8GM1H	S-1-5-19	1/16/2018 5:35:07 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WMIProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4924; ProviderPath = %systemroot%\system32\wbem\wmiprov.dll	5857	0	4611686018427387904	125	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	4924	428	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:35:04 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WmiPerfClass provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4924; ProviderPath = C:\Windows\System32\wbem\WmiPerfClass.dll	5857	0	4611686018427387904	124	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	4924	5928	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:35:03 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Namespace = ROOT\CIMV2; NotificationQuery = SELECT * FROM Win32_ProcessStartTrace WHERE ProcessName = 'wsmprovhost.exe'; UserName = ; ClientProcessID = 924, ClientMachine = WIN-5T344G8GM1H; PossibleCause = Temporary	5860	0	4611686018427387904	123	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2052	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:34:06 PM	a4626349-8ea8-0002-ed6e-62a4a88ed301	microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WMI Kernel Trace Event Provider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 924; ProviderPath = C:\Windows\System32\wbem\krnlprov.dll	5857	0	4611686018427387904	122	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2052	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:34:06 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 5028; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll	5857	0	4611686018427387904	121	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	5028	5328	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:32:53 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
nettcpip provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 5804; ProviderPath = %systemroot%\system32\wbem\NetTCPIP.dll	5857	0	4611686018427387904	120	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	5804	5824	WIN-5T344G8GM1H	S-1-5-20	1/16/2018 5:32:40 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NetAdapterCim provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3816; ProviderPath = %systemroot%\system32\wbem\NetAdapterCim.dll	5857	0	4611686018427387904	119	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	3816	1224	WIN-5T344G8GM1H	S-1-5-19	1/16/2018 5:32:40 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 5804; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll	5857	0	4611686018427387904	118	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	5804	5824	WIN-5T344G8GM1H	S-1-5-20	1/16/2018 5:32:40 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 5804; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll	5857	0	4611686018427387904	117	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	5804	912	WIN-5T344G8GM1H	S-1-5-20	1/16/2018 5:32:40 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3180; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll	5857	0	4611686018427387904	116	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	3180	804	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:22:47 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
nettcpip provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3772; ProviderPath = %systemroot%\system32\wbem\NetTCPIP.dll	5857	0	4611686018427387904	115	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	3772	5300	WIN-5T344G8GM1H	S-1-5-20	1/16/2018 5:22:40 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NetAdapterCim provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 888; ProviderPath = %systemroot%\system32\wbem\NetAdapterCim.dll	5857	0	4611686018427387904	114	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	888	5288	WIN-5T344G8GM1H	S-1-5-19	1/16/2018 5:22:40 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3772; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll	5857	0	4611686018427387904	113	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	3772	5300	WIN-5T344G8GM1H	S-1-5-20	1/16/2018 5:22:40 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3772; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll	5857	0	4611686018427387904	112	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	3772	3704	WIN-5T344G8GM1H	S-1-5-20	1/16/2018 5:22:40 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 5964; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll	5857	0	4611686018427387904	111	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	5964	3468	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:12:54 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {A4626349-8EA8-0000-8A6D-62A4A88ED301}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::ExecNotificationQuery - ROOT\CIMV2 : SELECT * FROM Win32_ProcessStartTrace WHERE ProcessName = 'wsmprovhost.exe'; ResultCode = 0x80041032; PossibleCause = Unknown	5858	2	4611686018427387904	110	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	1992	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:12:41 PM	a4626349-8ea8-0000-8a6d-62a4a88ed301	microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
nettcpip provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1260; ProviderPath = %systemroot%\system32\wbem\NetTCPIP.dll	5857	0	4611686018427387904	109	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	1260	1960	WIN-5T344G8GM1H	S-1-5-20	1/16/2018 5:12:40 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NetAdapterCim provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2736; ProviderPath = %systemroot%\system32\wbem\NetAdapterCim.dll	5857	0	4611686018427387904	108	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2736	2320	WIN-5T344G8GM1H	S-1-5-19	1/16/2018 5:12:40 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1260; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll	5857	0	4611686018427387904	107	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	1260	1960	WIN-5T344G8GM1H	S-1-5-20	1/16/2018 5:12:40 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1260; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll	5857	0	4611686018427387904	106	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	1260	1936	WIN-5T344G8GM1H	S-1-5-20	1/16/2018 5:12:40 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Namespace = ROOT\CIMV2; NotificationQuery = SELECT * FROM Win32_ProcessStartTrace WHERE ProcessName = 'wsmprovhost.exe'; UserName = ; ClientProcessID = 924, ClientMachine = WIN-5T344G8GM1H; PossibleCause = Temporary	5860	0	4611686018427387904	105	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	3016	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:06:17 PM	a4626349-8ea8-0003-146c-62a4a88ed301	microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WMI Kernel Trace Event Provider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 924; ProviderPath = C:\Windows\System32\wbem\krnlprov.dll	5857	0	4611686018427387904	104	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	3016	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:06:17 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
MSVDS__PROVIDER provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3428; ProviderPath = %systemroot%\system32\wbem\vdswmi.dll	5857	0	4611686018427387904	103	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	3428	5844	WIN-5T344G8GM1H	S-1-5-20	1/16/2018 5:06:06 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3428; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll	5857	0	4611686018427387904	102	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	3428	5844	WIN-5T344G8GM1H	S-1-5-20	1/16/2018 5:06:06 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WMIProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2768; ProviderPath = %systemroot%\system32\wbem\wmiprov.dll	5857	0	4611686018427387904	101	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2768	1104	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:05:59 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2856; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll	5857	0	4611686018427387904	100	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2856	3704	WIN-5T344G8GM1H	S-1-5-20	1/16/2018 5:04:01 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Namespace = //./root/CIMV2; NotificationQuery = select * from MSFT_SCMEventLogEvent; OwnerName = S-1-5-32-544; HostProcessID = 924; Provider= SCM Event Provider, queryID = 0; PossibleCause = Permanent	5859	0	4611686018427387904	99	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	3356	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:03:48 PM	a4626349-8ea8-0003-c36b-62a4a88ed301	microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Namespace = //./root/subscription; Eventfilter = SCM Event Log Filter (refer to its activate eventid:5859); Consumer = NTEventLogEventConsumer="SCM Event Log Consumer"; PossibleCause = Binding EventFilter: instance of __EventFilter { CreatorSID = {1, 2, 0, 0, 0, 0, 0, 5, 32, 0, 0, 0, 32, 2, 0, 0}; EventNamespace = "root\\cimv2"; Name = "SCM Event Log Filter"; Query = "select * from MSFT_SCMEventLogEvent"; QueryLanguage = "WQL"; }; Perm. Consumer: instance of NTEventLogEventConsumer { Category = 0; CreatorSID = {1, 2, 0, 0, 0, 0, 0, 5, 32, 0, 0, 0, 32, 2, 0, 0}; EventType = 1; Name = "SCM Event Log Consumer"; NameOfUserSIDProperty = "sid"; SourceName = "Service Control Manager"; };	5861	0	4611686018427387904	98	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	1768	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:03:48 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
MSVDS__PROVIDER provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2856; ProviderPath = %systemroot%\system32\wbem\vdswmi.dll	5857	0	4611686018427387904	97	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2856	3704	WIN-5T344G8GM1H	S-1-5-20	1/16/2018 5:02:51 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
nettcpip provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2856; ProviderPath = %systemroot%\system32\wbem\NetTCPIP.dll	5857	0	4611686018427387904	96	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2856	812	WIN-5T344G8GM1H	S-1-5-20	1/16/2018 5:02:39 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NetAdapterCim provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 5960; ProviderPath = %systemroot%\system32\wbem\NetAdapterCim.dll	5857	0	4611686018427387904	95	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	5960	5988	WIN-5T344G8GM1H	S-1-5-19	1/16/2018 5:02:39 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2856; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll	5857	0	4611686018427387904	94	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2856	3084	WIN-5T344G8GM1H	S-1-5-20	1/16/2018 5:02:39 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 2972; Component = Unknown; Operation = Start IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT ID FROM Win32_ServerFeature; ResultCode = 0x80041032; PossibleCause = Unknown	5858	2	4611686018427387904	93	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2352	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:13 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{FB2CA36D-0B40-4307-821B-A13B252DE56C}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	92	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2512	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:11 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{F9C77450-3A41-477E-9310-9ACD617BD9E3}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	91	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2512	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:11 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{E62688F0-25FD-4c90-BFF5-F508B9D2E31F}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	90	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2512	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:11 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{E5094040-C46C-4115-B030-04FB2E545B00}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	89	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2512	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:11 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{E4F48E54-F38D-4884-BFB9-D4D2E5729C18}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	88	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2512	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:11 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{E47248BA-94CC-49c4-BBB5-9EB7F05183D0}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	87	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2512	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:11 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{CF7639F3-ABA2-41DB-97F2-81E2C5DBFC5D}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	86	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2512	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:11 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{c6dc5466-785a-11d2-84d0-00c04fb169f7}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	85	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2512	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:11 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{C631DF4C-088F-4156-B058-4375F0853CD8}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	84	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2512	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:11 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{C418DD9D-0D14-4efb-8FBF-CFE535C8FAC7}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	83	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2512	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:11 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{C34B2751-1CF4-44F5-9262-C3FC39666591}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	82	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2512	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:11 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{BC75B1ED-5833-4858-9BB8-CBF0B166DF9D}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	81	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2512	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:11 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{BA649533-0AAC-4E04-B9BC-4DBAE0325B12}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	80	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2512	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:11 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{B087BE9D-ED37-454f-AF9C-04291E351182}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	79	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2512	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:11 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{AADCED64-746C-4633-A97C-D61349046527}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	78	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2512	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:11 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{A3F3E39B-5D83-4940-B954-28315B82F0A8}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	77	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2512	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:11 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{91FBB303-0CD5-4055-BF42-E512A681B325}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	76	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2512	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:11 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{8A28E2C5-8D06-49A4-A08C-632DAA493E17}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	75	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2512	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:11 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{7B849a69-220F-451E-B3FE-2CB811AF94AE}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	74	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2512	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:11 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{7933F41E-56F8-41d6-A31C-4148A711EE93}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	73	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2512	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:11 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{74EE6C03-5363-4554-B161-627540339CAB}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	72	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2512	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:11 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{728EE579-943C-4519-9EF7-AB56765798ED}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	71	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2512	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:11 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{7150F9BF-48AD-4da4-A49C-29EF4A8369BA}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	70	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2512	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:11 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{6232C319-91AC-4931-9385-E70C2B099F0E}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	69	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2512	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:11 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{5794DAFD-BE60-433f-88A2-1A31939AC01F}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	68	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2512	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:11 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{4D2F9B6F-1E52-4711-A382-6A8B1A003DE6}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	67	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2512	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:11 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{4CFB60C1-FAA6-47f1-89AA-0B18730C9FD3}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	66	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2512	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:11 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{4B7C3B0F-E993-4E06-A241-3FBE06943684}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	65	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2512	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:11 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{42B5FAAE-6536-11d2-AE5A-0000F87571E3}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	64	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2512	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:11 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{3A0DBA37-F8B2-4356-83DE-3E90BD5C261F}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	63	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2512	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:11 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{2BFCC077-22D2-48DE-BDE1-2F618D9B476D}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	62	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2512	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:11 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{25537BA6-77A8-11D2-9B6C-0000F8080861}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	61	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2512	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:11 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{1A6364EB-776B-4120-ADE1-B63A406A76B5}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	60	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2512	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:11 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{17D89FEC-5C44-4972-B12D-241CAEF74509}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	59	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2512	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:11 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{169EBF44-942F-4C43-87CE-13C93996EBBE}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	58	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2512	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:11 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{0E28E245-9368-4853-AD84-6DA3BA35BB75}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	57	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2512	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:11 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WMIProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2768; ProviderPath = %systemroot%\system32\wbem\wmiprov.dll	5857	0	4611686018427387904	56	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2768	1124	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:11 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WMIProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2768; ProviderPath = %systemroot%\system32\wbem\wmiprov.dll	5857	0	4611686018427387904	55	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2768	1124	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:11 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{FC491EF1-C4AA-4CE1-B329-414B101DB823}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	54	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2528	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:09 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{fbf687e6-f063-4d9f-9f4f-fd9a26acdd5f}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	53	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2528	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:09 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{FB2CA36D-0B40-4307-821B-A13B252DE56C}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	52	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2528	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:09 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{f3ccc681-b74c-4060-9f26-cd84525dca2a}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	51	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2528	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:09 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{F312195E-3D9D-447A-A3F5-08DFFA24735E}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	50	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2528	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:09 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{E62688F0-25FD-4c90-BFF5-F508B9D2E31F}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	49	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2528	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:09 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{E5094040-C46C-4115-B030-04FB2E545B00}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	48	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2528	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:09 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{E4F48E54-F38D-4884-BFB9-D4D2E5729C18}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	47	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2528	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:09 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{e437bc1c-aa7d-11d2-a382-00c04f991e27}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	46	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2528	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:09 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{CF7639F3-ABA2-41DB-97F2-81E2C5DBFC5D}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	45	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2528	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:09 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{cdeafc3d-948d-49dd-ab12-e578ba4af7aa}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	44	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2528	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:09 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{c6dc5466-785a-11d2-84d0-00c04fb169f7}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	43	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2528	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:09 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{C631DF4C-088F-4156-B058-4375F0853CD8}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	42	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2528	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:09 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{C418DD9D-0D14-4efb-8FBF-CFE535C8FAC7}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	41	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2528	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:09 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{C34B2751-1CF4-44F5-9262-C3FC39666591}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	40	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2528	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:09 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{BC75B1ED-5833-4858-9BB8-CBF0B166DF9D}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	39	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2528	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:09 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{BA649533-0AAC-4E04-B9BC-4DBAE0325B12}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	38	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2528	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:09 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{B587E2B1-4D59-4e7e-AED9-22B9DF11D053}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	37	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2528	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:09 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{B087BE9D-ED37-454f-AF9C-04291E351182}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	36	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2528	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:09 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{AADCED64-746C-4633-A97C-D61349046527}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	35	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2528	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:09 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{A3F3E39B-5D83-4940-B954-28315B82F0A8}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	34	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2528	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:09 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{91FBB303-0CD5-4055-BF42-E512A681B325}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	33	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2528	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:09 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{8A28E2C5-8D06-49A4-A08C-632DAA493E17}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	32	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2528	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:09 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{827D319E-6EAC-11D2-A4EA-00C04F79F83A}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	31	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2528	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:09 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{7B849a69-220F-451E-B3FE-2CB811AF94AE}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	30	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2528	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:09 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{7933F41E-56F8-41d6-A31C-4148A711EE93}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	29	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2528	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:09 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{74EE6C03-5363-4554-B161-627540339CAB}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	28	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2528	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:09 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{728EE579-943C-4519-9EF7-AB56765798ED}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	27	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2528	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:09 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{7150F9BF-48AD-4da4-A49C-29EF4A8369BA}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	26	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2528	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:09 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{6A4C88C6-C502-4f74-8F60-2CB23EDC24E2}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	25	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2528	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:09 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{6232C319-91AC-4931-9385-E70C2B099F0E}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	24	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2528	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:09 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{4CFB60C1-FAA6-47f1-89AA-0B18730C9FD3}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	23	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2528	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:09 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{4bcd6cde-777b-48b6-9804-43568e23545d}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	22	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2528	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:09 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{4B7C3B0F-E993-4E06-A241-3FBE06943684}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	21	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2528	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:09 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{42B5FAAE-6536-11d2-AE5A-0000F87571E3}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	20	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2528	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:09 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{426031c0-0b47-4852-b0ca-ac3d37bfcb39}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	19	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2528	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:09 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{3A0DBA37-F8B2-4356-83DE-3E90BD5C261F}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	18	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2528	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:09 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{3610eda5-77ef-11d2-8dc5-00c04fa31a66}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	17	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2528	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:09 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{2BFCC077-22D2-48DE-BDE1-2F618D9B476D}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	16	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2528	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:09 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{2A8FDC61-2347-4C87-92F6-B05EB91A201A}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	15	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2528	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:09 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{1A6364EB-776B-4120-ADE1-B63A406A76B5}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	14	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2528	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:09 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{17D89FEC-5C44-4972-B12D-241CAEF74509}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	13	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2528	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:09 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{16be69fa-4209-4250-88cb-716cf41954e0}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	12	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2528	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:09 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{169EBF44-942F-4C43-87CE-13C93996EBBE}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	11	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2528	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:09 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{0E28E245-9368-4853-AD84-6DA3BA35BB75}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	10	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2528	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:09 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{0ACDD40C-75AC-47ab-BAA0-BF6DE7E7FE63}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	9	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2528	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:09 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{35378EAC-683F-11D2-A89A-00C04FBBCFA2}"; ResultCode = 0x80041002; PossibleCause = Unknown	5858	2	4611686018427387904	8	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2528	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:09 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3440; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll	5857	0	4611686018427387904	7	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	3440	3468	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:09 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
ServerFeatureProvider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2856; ProviderPath = %windir%\system32\wbem\servercompprov.dll	5857	0	4611686018427387904	6	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2856	3084	WIN-5T344G8GM1H	S-1-5-20	1/16/2018 5:02:09 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 2972; Component = Unknown; Operation = Start IWbemServices::ExecQuery - ROOT\CIMV2 : select ChassisTypes from Win32_SystemEnclosure; ResultCode = 0x80041032; PossibleCause = Unknown	5858	2	4611686018427387904	5	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	924	2484	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:09 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32a provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2856; ProviderPath = %systemroot%\system32\wbem\wmipcima.dll	5857	0	4611686018427387904	4	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2856	3084	WIN-5T344G8GM1H	S-1-5-20	1/16/2018 5:02:06 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2856; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll	5857	0	4611686018427387904	3	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	2856	2436	WIN-5T344G8GM1H	S-1-5-20	1/16/2018 5:02:05 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-PD8DQPRRTAO; User = NT AUTHORITY\SYSTEM; ClientProcessId = 2508; Component = Unknown; Operation = Start IWbemServices::CreateInstanceEnum - root\wmi : MSiSCSI_PortalInfoClass; ResultCode = 0x8004100A; PossibleCause = Unknown	5858	2	4611686018427387904	2	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	916	2392	WIN-PD8DQPRRTAO	S-1-5-18	1/16/2018 5:01:40 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-PD8DQPRRTAO; User = NT AUTHORITY\SYSTEM; ClientProcessId = 2508; Component = Unknown; Operation = Start IWbemServices::CreateInstanceEnum - root\wmi : MS_SM_AdapterInformationQuery; ResultCode = 0x8004100A; PossibleCause = Unknown	5858	2	4611686018427387904	1	Microsoft-Windows-WMI-Activity	1418ef04-b0b4-4623-bf7e-d74ab47bbdaa	Microsoft-Windows-WMI-Activity/Operational	916	2392	WIN-PD8DQPRRTAO	S-1-5-18	1/16/2018 5:01:40 PM		microsoft-windows-wmi-activity/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]