MessageIdVersionQualifiersLevelTaskOpcodeKeywordsRecordIdProviderNameProviderIdLogNameProcessIdThreadIdMachineNameUserIdTimeCreatedActivityIdRelatedActivityIdContainerLogMatchedQueryIdsBookmarkLevelDisplayNameOpcodeDisplayNameTaskDisplayNameKeywordsDisplayNamesProperties
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3160; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll585700004611686018427387904843Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational31603332hv-cinder-85920S-1-5-209/26/2022 1:50:10 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3996; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll585700004611686018427387904842Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational39964988hv-cinder-85920S-1-5-189/26/2022 1:48:30 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3160; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll585700004611686018427387904841Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational31604812hv-cinder-85920S-1-5-209/26/2022 1:48:30 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {55D893AB-B6E5-4864-8E91-D18E998CE344}; ClientMachine = HV-CINDER-85920; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4836; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1601345998; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904840Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6203224hv-cinder-85920S-1-5-189/26/2022 1:48:12 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {E9FF5E0E-D8B1-444E-A5ED-AE6A47146F19}; ClientMachine = HV-CINDER-85920; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4836; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Host.HostName="iqn.2010-10.org.openstack:volume-6aed11c5-7a98-4988-b296-f8a98473259d"; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904839Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6201304hv-cinder-85920S-1-5-189/26/2022 1:48:10 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {5372A08D-D532-403D-9E97-24DD2597AE62}; ClientMachine = HV-CINDER-85920; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4836; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_IDMethod.HostName="iqn.2010-10.org.openstack:volume-6aed11c5-7a98-4988-b296-f8a98473259d",Method=4,Value="iqn.1991-05.com.microsoft:hv-cinder-85920"; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904838Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6203224hv-cinder-85920S-1-5-189/26/2022 1:48:10 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {60871FA2-5921-4F87-879E-250F722C5386}; ClientMachine = HV-CINDER-85920; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4836; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{2C11FC2C-EA19-41E1-AF53-2AD22BBA4D8E}"; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904837Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6201272hv-cinder-85920S-1-5-189/26/2022 1:48:05 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {5B7BF3B2-933D-412E-BE34-99F5707D5F4D}; ClientMachine = HV-CINDER-85920; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4836; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=801150087; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904836Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6201272hv-cinder-85920S-1-5-189/26/2022 1:48:04 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {7254E8F5-9710-4218-BFB5-10D6F5DB0578}; ClientMachine = HV-CINDER-85920; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4836; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Host.HostName="iqn.2010-10.org.openstack:volume-d1932ae6-3fd0-4412-af45-9043f16e2097"; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904835Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6201272hv-cinder-85920S-1-5-189/26/2022 1:48:03 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {3146F44E-A5D7-40ED-A801-3B4148582293}; ClientMachine = HV-CINDER-85920; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4836; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_IDMethod.HostName="iqn.2010-10.org.openstack:volume-d1932ae6-3fd0-4412-af45-9043f16e2097",Method=4,Value="iqn.1991-05.com.microsoft:hv-cinder-85920"; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904834Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6201836hv-cinder-85920S-1-5-189/26/2022 1:48:03 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
StorageWMI provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3160; ProviderPath = %SystemRoot%\System32\storagewmi.dll585700004611686018427387904833Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational31604812hv-cinder-85920S-1-5-209/26/2022 1:48:02 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {28C3C993-D1CC-4791-8781-5131687AAD7E}; ClientMachine = HV-CINDER-85920; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4836; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1590322326; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904832Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6203224hv-cinder-85920S-1-5-189/26/2022 1:47:33 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {674E4F7A-8CC8-4AB8-A0A0-975648EB038A}; ClientMachine = HV-CINDER-85920; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4836; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=547957418; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904831Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6201272hv-cinder-85920S-1-5-189/26/2022 1:47:26 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {0667C92E-B867-4992-95E9-36ACE02C2EAE}; ClientMachine = HV-CINDER-85920; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4836; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{D19BE039-9BB7-4AD0-BBAB-85AD826FBD62}"; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904830Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6201836hv-cinder-85920S-1-5-189/26/2022 1:47:25 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {2098A058-75D4-4367-A844-D9AA58093C0F}; ClientMachine = HV-CINDER-85920; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4836; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{9E246F8D-3F27-4F56-9B60-A822D4984DCB}"; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904829Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6201272hv-cinder-85920S-1-5-189/26/2022 1:47:23 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {A45A5CC4-C091-4B52-A003-03AF5B7E9B92}; ClientMachine = HV-CINDER-85920; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4836; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{339386FE-DE6D-41E8-87A7-73B7D1D8B244}"; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904828Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6201836hv-cinder-85920S-1-5-189/26/2022 1:47:19 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {272CE255-A396-4881-81C6-2C3E88270E2B}; ClientMachine = HV-CINDER-85920; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4836; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{D6F8D6C1-2DE4-407D-9A3F-2986AECA35B9}"; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904827Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6201272hv-cinder-85920S-1-5-189/26/2022 1:47:14 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {E38FAEF6-F8AD-4A7D-9759-CBE96862C8D9}; ClientMachine = HV-CINDER-85920; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4836; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{BC0FD8D4-B9DF-4A0D-9EA2-3C5CF79F298C}"; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904826Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6201272hv-cinder-85920S-1-5-189/26/2022 1:47:10 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {AD1672D6-9D55-4608-8CC2-0FDEF35EC3B2}; ClientMachine = HV-CINDER-85920; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4836; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1457460772; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904825Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6201272hv-cinder-85920S-1-5-189/26/2022 1:46:48 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {B59D5BBC-E8ED-4776-890F-9E999CCBEBB1}; ClientMachine = HV-CINDER-85920; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4836; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=2076332962; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904824Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6201836hv-cinder-85920S-1-5-189/26/2022 1:46:47 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {8EA4945A-6C9E-41B9-BD28-936C51E1A618}; ClientMachine = HV-CINDER-85920; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4836; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1930637249; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904823Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6201272hv-cinder-85920S-1-5-189/26/2022 1:46:45 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {DBE149FD-02AE-4FDC-B401-FA2D923AB332}; ClientMachine = HV-CINDER-85920; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4836; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Host.HostName="iqn.2010-10.org.openstack:volume-057a9b04-20e9-41ff-a3d3-0a291c431ed7"; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904822Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6201836hv-cinder-85920S-1-5-189/26/2022 1:46:40 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {10DBB5C4-8571-4F6B-843F-2B02F997AF7A}; ClientMachine = HV-CINDER-85920; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4836; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_IDMethod.HostName="iqn.2010-10.org.openstack:volume-057a9b04-20e9-41ff-a3d3-0a291c431ed7",Method=4,Value="iqn.1991-05.com.microsoft:hv-cinder-85920"; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904821Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6201836hv-cinder-85920S-1-5-189/26/2022 1:46:40 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {6D47A0AE-58D1-4C67-9605-6C2488ED43E2}; ClientMachine = HV-CINDER-85920; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4836; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=514235051; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904820Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6201836hv-cinder-85920S-1-5-189/26/2022 1:46:03 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {DC447A52-7C0A-4A5F-9CBB-6E2EB75C1844}; ClientMachine = HV-CINDER-85920; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4836; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Host.HostName="iqn.2010-10.org.openstack:volume-0c7c2991-1c84-4293-baef-09b2ebc455fb"; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904819Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6201836hv-cinder-85920S-1-5-189/26/2022 1:46:02 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {97C35AF6-C01B-4B14-A00E-CD4CA528C2A2}; ClientMachine = HV-CINDER-85920; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4836; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_IDMethod.HostName="iqn.2010-10.org.openstack:volume-0c7c2991-1c84-4293-baef-09b2ebc455fb",Method=4,Value="iqn.1991-05.com.microsoft:hv-cinder-85920"; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904818Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6201836hv-cinder-85920S-1-5-189/26/2022 1:46:01 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {AB2221F6-6AC2-4124-AF77-35051323F25C}; ClientMachine = HV-CINDER-85920; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4836; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1806796356; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904817Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational620664hv-cinder-85920S-1-5-189/26/2022 1:46:01 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {3E4020A7-CDFF-44E6-8296-487192CD1093}; ClientMachine = HV-CINDER-85920; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4836; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Host.HostName="iqn.2010-10.org.openstack:volume-cdd01565-f5d6-4497-8958-ee77016ec249"; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904816Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational620664hv-cinder-85920S-1-5-189/26/2022 1:45:37 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {859E46E6-40F9-4638-BE25-9F27E56D3D13}; ClientMachine = HV-CINDER-85920; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4836; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_IDMethod.HostName="iqn.2010-10.org.openstack:volume-cdd01565-f5d6-4497-8958-ee77016ec249",Method=4,Value="iqn.1991-05.com.microsoft:hv-cinder-85920"; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904815Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational620664hv-cinder-85920S-1-5-189/26/2022 1:45:36 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
StorageWMI provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3160; ProviderPath = %SystemRoot%\System32\storagewmi.dll585700004611686018427387904814Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational31604812hv-cinder-85920S-1-5-209/26/2022 1:45:28 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
MSVSS__PROVIDER provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3160; ProviderPath = %systemroot%\system32\wbem\vsswmi.dll585700004611686018427387904813Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational31604812hv-cinder-85920S-1-5-209/26/2022 1:45:27 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WinTargetProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 5076; ProviderPath = C:\windows\system32\wbem\WTWMIProv.dll585700004611686018427387904812Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational50762136hv-cinder-85920S-1-5-199/26/2022 1:45:27 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {8DBA8208-8264-4128-A037-A088EF0500A0}; ClientMachine = HV-CINDER-85920; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4836; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Host.HostName="iqn.2010-10.org.openstack:volume-1a237830-3bec-4f63-b7a1-a9a0e9a5ad1a"; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904811Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational620664hv-cinder-85920S-1-5-189/26/2022 1:44:29 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {7F802AEA-E504-45D2-AAE9-F1DDA934C3DF}; ClientMachine = HV-CINDER-85920; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4836; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_IDMethod.HostName="iqn.2010-10.org.openstack:volume-1a237830-3bec-4f63-b7a1-a9a0e9a5ad1a",Method=4,Value="iqn.1991-05.com.microsoft:hv-cinder-85920"; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904810Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6203224hv-cinder-85920S-1-5-189/26/2022 1:44:29 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {02D46181-323A-4E6C-AD4E-6C83BD6701DE}; ClientMachine = HV-CINDER-85920; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4836; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=484463629; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904809Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6203224hv-cinder-85920S-1-5-189/26/2022 1:44:24 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9FE5B974-4CE6-4F78-98FD-5B31AE22DAAB}; ClientMachine = HV-CINDER-85920; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4836; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Host.HostName="iqn.2010-10.org.openstack:volume-e4642695-91e0-403a-8f7b-6ea29e100d5f"; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904808Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6204556hv-cinder-85920S-1-5-189/26/2022 1:44:24 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {A9211590-6E82-4FD7-9361-A6289333D47A}; ClientMachine = HV-CINDER-85920; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4836; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_IDMethod.HostName="iqn.2010-10.org.openstack:volume-e4642695-91e0-403a-8f7b-6ea29e100d5f",Method=4,Value="iqn.1991-05.com.microsoft:hv-cinder-85920"; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904807Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational620664hv-cinder-85920S-1-5-189/26/2022 1:44:24 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {D59B495D-63A3-4159-9A69-4D32371CE5E1}; ClientMachine = HV-CINDER-85920; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4836; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1253759584; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904806Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6204556hv-cinder-85920S-1-5-189/26/2022 1:44:01 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {B4EF4B9E-7138-4607-A2CB-F0231F32A812}; ClientMachine = HV-CINDER-85920; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4836; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Host.HostName="iqn.2010-10.org.openstack:volume-6aed11c5-7a98-4988-b296-f8a98473259d"; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904805Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6201924hv-cinder-85920S-1-5-189/26/2022 1:43:51 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {3C484E6E-1AF9-429D-A2C7-EAE7C232CDD1}; ClientMachine = HV-CINDER-85920; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4836; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_IDMethod.HostName="iqn.2010-10.org.openstack:volume-6aed11c5-7a98-4988-b296-f8a98473259d",Method=4,Value="iqn.1991-05.com.microsoft:hv-cinder-85920"; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904804Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6201924hv-cinder-85920S-1-5-189/26/2022 1:43:51 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {B2FC5AD1-FC6E-4B2C-949C-0E73F29F0E5B}; ClientMachine = HV-CINDER-85920; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4836; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1585641943; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904803Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6203224hv-cinder-85920S-1-5-189/26/2022 1:43:41 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {01CAD670-7C71-475F-B54B-F0847BA79A5C}; ClientMachine = HV-CINDER-85920; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4836; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1199857459; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904802Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6201924hv-cinder-85920S-1-5-189/26/2022 1:43:37 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {482B044C-130E-4E9A-A28E-A2D0439A47F0}; ClientMachine = HV-CINDER-85920; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4836; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1426198303; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904801Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6202804hv-cinder-85920S-1-5-189/26/2022 1:43:31 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {DABD2658-82AE-4EFD-95E2-C0C59BF7AFD3}; ClientMachine = HV-CINDER-85920; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4836; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=306157215; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904800Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6201924hv-cinder-85920S-1-5-189/26/2022 1:43:31 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {EBCC1946-0E6F-4961-8581-88A80FB3492D}; ClientMachine = HV-CINDER-85920; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4836; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1098843969; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904799Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6202804hv-cinder-85920S-1-5-189/26/2022 1:43:30 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {678A8E55-2C1D-411E-8F99-BD4A683FCD9E}; ClientMachine = HV-CINDER-85920; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4836; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1089007718; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904798Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6202804hv-cinder-85920S-1-5-189/26/2022 1:43:29 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {A66BD77B-5C41-4C66-8C16-BDEA433144A1}; ClientMachine = HV-CINDER-85920; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4836; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=646807784; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904797Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6204556hv-cinder-85920S-1-5-189/26/2022 1:43:19 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {98F54F76-B43A-4ACC-9F87-5BEB008378FC}; ClientMachine = HV-CINDER-85920; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4836; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1821839060; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904796Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6201924hv-cinder-85920S-1-5-189/26/2022 1:43:18 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FE3E0A1D-13F2-47A2-B496-0B0D1D5557AA}; ClientMachine = HV-CINDER-85920; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4836; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1890089290; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904795Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6204556hv-cinder-85920S-1-5-189/26/2022 1:43:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {8BDEC1FB-48B9-4831-983C-BD12C9F53E25}; ClientMachine = HV-CINDER-85920; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4836; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{932883B5-5CF8-4F7F-B425-C5D446D5B594}"; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904794Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6201924hv-cinder-85920S-1-5-189/26/2022 1:43:16 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {D51F0363-B854-4755-8EE8-B67A34927F17}; ClientMachine = HV-CINDER-85920; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4836; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1201513354; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904793Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6204556hv-cinder-85920S-1-5-189/26/2022 1:43:16 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {41D223A1-B3B7-4031-93DF-C6CEE3AF59E4}; ClientMachine = HV-CINDER-85920; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4836; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1404468169; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904792Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6201924hv-cinder-85920S-1-5-189/26/2022 1:43:16 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {876996AF-CBE0-4764-87CD-0E7FA42F29D7}; ClientMachine = HV-CINDER-85920; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4836; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=264071559; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904791Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6201144hv-cinder-85920S-1-5-189/26/2022 1:43:07 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {166629D2-B2E0-4472-ACA7-1518A83180C5}; ClientMachine = HV-CINDER-85920; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4836; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=11962456; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904790Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6203224hv-cinder-85920S-1-5-189/26/2022 1:43:00 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {35FC5B73-BB0B-45C9-B434-E796C077F103}; ClientMachine = HV-CINDER-85920; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4836; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1579121889; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904789Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6203224hv-cinder-85920S-1-5-189/26/2022 1:42:59 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {33804C53-898F-4459-AE64-5903C73747A5}; ClientMachine = HV-CINDER-85920; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4836; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1061985585; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904788Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6203224hv-cinder-85920S-1-5-189/26/2022 1:42:58 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {43644745-4FE9-4030-9DF4-7D6EA7055E65}; ClientMachine = HV-CINDER-85920; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4836; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Host.HostName="iqn.2010-10.org.openstack:volume-cac5ec09-34ee-4f49-a885-9a6f06f8fd20"; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904787Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6201144hv-cinder-85920S-1-5-189/26/2022 1:42:51 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9AA23D00-FE98-4F04-B758-00855850CEFA}; ClientMachine = HV-CINDER-85920; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4836; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_IDMethod.HostName="iqn.2010-10.org.openstack:volume-cac5ec09-34ee-4f49-a885-9a6f06f8fd20",Method=4,Value="iqn.1991-05.com.microsoft:hv-cinder-85920"; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904786Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6201144hv-cinder-85920S-1-5-189/26/2022 1:42:51 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {F738214D-F462-4070-B985-4179846FC1C3}; ClientMachine = HV-CINDER-85920; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4836; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Host.HostName="iqn.2010-10.org.openstack:volume-bd909068-7fcc-4d42-a2b9-bc1de57fe055"; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904785Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6201144hv-cinder-85920S-1-5-189/26/2022 1:42:50 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {1D48A970-873E-4C0E-AA75-3FA0F2504DEA}; ClientMachine = HV-CINDER-85920; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4836; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_IDMethod.HostName="iqn.2010-10.org.openstack:volume-bd909068-7fcc-4d42-a2b9-bc1de57fe055",Method=4,Value="iqn.1991-05.com.microsoft:hv-cinder-85920"; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904784Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6201144hv-cinder-85920S-1-5-189/26/2022 1:42:50 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {8BE3E61F-26F7-4E85-9CAF-C2156FD5CA1A}; ClientMachine = HV-CINDER-85920; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4836; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Host.HostName="iqn.2010-10.org.openstack:volume-e4642695-91e0-403a-8f7b-6ea29e100d5f"; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904783Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6203224hv-cinder-85920S-1-5-189/26/2022 1:42:30 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {19488AB5-C34B-4C9C-8FC2-0F89C135B7DF}; ClientMachine = HV-CINDER-85920; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4836; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_IDMethod.HostName="iqn.2010-10.org.openstack:volume-e4642695-91e0-403a-8f7b-6ea29e100d5f",Method=4,Value="iqn.1991-05.com.microsoft:hv-cinder-85920"; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904782Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6203224hv-cinder-85920S-1-5-189/26/2022 1:42:30 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {5550B5BA-4847-487B-B187-27DF7026BA83}; ClientMachine = HV-CINDER-85920; User = NT AUTHORITY\SYSTEM; ClientProcessId = 2264; Component = Unknown; Operation = Start IWbemServices::GetObject - ROOT\virtualization\v2 : \\.\ROOT\virtualization\v2:Msvm_ConcreteJob.InstanceID="8F1B4DAA-E1E2-4437-9DDB-15F295DD4ED9"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904781Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6201836hv-cinder-85920S-1-5-189/26/2022 1:42:01 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {B0C2539D-2B41-4262-B96C-C1993C418CFE}; ClientMachine = HV-CINDER-85920; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4836; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1044292188; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904780Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6201836hv-cinder-85920S-1-5-189/26/2022 1:41:58 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {3E548B2F-2930-4E20-BBEA-20FC642D1233}; ClientMachine = HV-CINDER-85920; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4836; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1955918753; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904779Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6201836hv-cinder-85920S-1-5-189/26/2022 1:41:57 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {A56D0A65-0674-414B-A922-083E81DCDE24}; ClientMachine = HV-CINDER-85920; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4836; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Host.HostName="iqn.2010-10.org.openstack:volume-a61f5f0d-04c8-4680-ba47-06afe4723899"; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904778Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6201144hv-cinder-85920S-1-5-189/26/2022 1:41:50 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {D1A782C2-96FA-4767-89BC-01B6C57E56CC}; ClientMachine = HV-CINDER-85920; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4836; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_IDMethod.HostName="iqn.2010-10.org.openstack:volume-a61f5f0d-04c8-4680-ba47-06afe4723899",Method=4,Value="iqn.1991-05.com.microsoft:hv-cinder-85920"; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904777Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6201144hv-cinder-85920S-1-5-189/26/2022 1:41:50 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {F32D8A20-5B89-4EF1-B5AA-80377E950088}; ClientMachine = HV-CINDER-85920; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4836; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=353469066; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904776Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6201272hv-cinder-85920S-1-5-189/26/2022 1:41:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {72E2D2EE-0241-40EF-99DB-33FF90438580}; ClientMachine = HV-CINDER-85920; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4836; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=47377426; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904775Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6204556hv-cinder-85920S-1-5-189/26/2022 1:41:16 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96C143C2-0B92-40F7-9AA7-FA25E15A80E0}; ClientMachine = HV-CINDER-85920; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4836; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1304703377; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904774Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational620664hv-cinder-85920S-1-5-189/26/2022 1:41:14 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {68A5404B-6D2E-4361-94E4-B7951C72E213}; ClientMachine = HV-CINDER-85920; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4836; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=770856090; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904773Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6203224hv-cinder-85920S-1-5-189/26/2022 1:41:04 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {A9F7CB06-C130-40FD-81E0-39E8B85D113F}; ClientMachine = HV-CINDER-85920; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4836; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=18838487; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904772Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6201924hv-cinder-85920S-1-5-189/26/2022 1:41:03 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {24819972-F6F9-4332-ABE5-85F52177781E}; ClientMachine = HV-CINDER-85920; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4836; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=364089345; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904771Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational620664hv-cinder-85920S-1-5-189/26/2022 1:41:02 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {0C42F521-9727-4B60-9276-666D203A5CA2}; ClientMachine = HV-CINDER-85920; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4836; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=696938730; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904770Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational620664hv-cinder-85920S-1-5-189/26/2022 1:40:49 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {EE9D3434-8ABF-4292-BDBC-EC11D44E5EEA}; ClientMachine = HV-CINDER-85920; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4836; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{7FA3962D-3AEF-42BD-82FD-6B58C44B29DA}"; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904769Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6201924hv-cinder-85920S-1-5-189/26/2022 1:40:47 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {CDAC0C1B-70A9-47D4-916F-42107BCAD538}; ClientMachine = HV-CINDER-85920; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4836; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=886012180; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904768Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6201924hv-cinder-85920S-1-5-189/26/2022 1:40:42 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {5EDF3C23-2703-418B-B400-8A774F289353}; ClientMachine = HV-CINDER-85920; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4836; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=679326952; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904767Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational620664hv-cinder-85920S-1-5-189/26/2022 1:40:41 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {2CD744EC-6E96-4D7A-87B8-E68F7440EF9F}; ClientMachine = HV-CINDER-85920; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4836; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Host.HostName="iqn.2010-10.org.openstack:volume-bf0853bc-0bc2-45e7-9cdd-c4288c822bfb"; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904766Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6203224hv-cinder-85920S-1-5-189/26/2022 1:40:40 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FC503C9B-A0DE-49AC-973B-39DF0A6241D1}; ClientMachine = HV-CINDER-85920; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4836; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_IDMethod.HostName="iqn.2010-10.org.openstack:volume-bf0853bc-0bc2-45e7-9cdd-c4288c822bfb",Method=4,Value="iqn.1991-05.com.microsoft:hv-cinder-85920"; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904765Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6203224hv-cinder-85920S-1-5-189/26/2022 1:40:40 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9F9DFB35-87D6-4930-BDA9-44DC8EE212B7}; ClientMachine = HV-CINDER-85920; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4836; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=2086038481; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904764Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6203224hv-cinder-85920S-1-5-189/26/2022 1:40:40 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FCED78C0-C232-49A5-A045-D4368861B7C7}; ClientMachine = HV-CINDER-85920; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4836; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1298244940; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904763Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6201304hv-cinder-85920S-1-5-189/26/2022 1:40:38 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {2616D2A6-7DAE-4882-B90B-E4CCF96475ED}; ClientMachine = HV-CINDER-85920; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4836; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{9817EC9A-336E-4EBE-A670-F674E2CBD2B0}"; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904762Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational620664hv-cinder-85920S-1-5-189/26/2022 1:40:38 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {AB871EF9-17DF-4654-9E73-FA5055D66C49}; ClientMachine = HV-CINDER-85920; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4836; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1489562458; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904761Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6201836hv-cinder-85920S-1-5-189/26/2022 1:40:38 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {05A1F759-A3C2-451A-B554-96D453C3710E}; ClientMachine = HV-CINDER-85920; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4836; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1498145691; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904760Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6201836hv-cinder-85920S-1-5-189/26/2022 1:40:38 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {F11303A9-FBB1-4C5B-94E6-2A53D0C5AEA3}; ClientMachine = HV-CINDER-85920; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4836; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{1D779EF7-E457-48DB-A422-CFF8C4676C5C}"; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904759Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational620664hv-cinder-85920S-1-5-189/26/2022 1:40:34 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {CCFEA7AD-FE93-4ADC-9FFE-5D576F0050BB}; ClientMachine = HV-CINDER-85920; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4836; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1689612312; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904758Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational620664hv-cinder-85920S-1-5-189/26/2022 1:40:33 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {EE58DB40-02F3-4177-94BE-5C435CB76D0E}; ClientMachine = HV-CINDER-85920; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4836; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1976729167; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904757Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational620664hv-cinder-85920S-1-5-189/26/2022 1:40:32 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {657F4153-204C-48F4-95E5-1CE0F46DBF5D}; ClientMachine = HV-CINDER-85920; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4836; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{AD0328C7-BB12-49AD-9F09-600CF8E01815}"; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904756Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6201836hv-cinder-85920S-1-5-189/26/2022 1:40:31 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {07C42D46-3B5C-43A5-8152-398D387D2891}; ClientMachine = HV-CINDER-85920; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4836; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=160413070; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904755Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational620664hv-cinder-85920S-1-5-189/26/2022 1:40:31 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {619B3262-E83D-451B-AA2F-540BAC6443EF}; ClientMachine = HV-CINDER-85920; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4836; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1433698610; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904754Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6201836hv-cinder-85920S-1-5-189/26/2022 1:40:30 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {55685E6A-F83A-4744-AB26-4B1A497A4CFB}; ClientMachine = HV-CINDER-85920; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4836; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1295836052; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904753Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6201836hv-cinder-85920S-1-5-189/26/2022 1:40:29 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {5623EBC0-DA03-4247-A328-C36ABD82DA9C}; ClientMachine = HV-CINDER-85920; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4836; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Host.HostName="iqn.2010-10.org.openstack:volume-4a2fdfd2-6791-4e92-b71f-09e7980dd8b6"; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904752Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational620664hv-cinder-85920S-1-5-189/26/2022 1:40:24 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {83905172-3DA6-4901-B6C7-CC1FDA65CB42}; ClientMachine = HV-CINDER-85920; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4836; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_IDMethod.HostName="iqn.2010-10.org.openstack:volume-4a2fdfd2-6791-4e92-b71f-09e7980dd8b6",Method=4,Value="iqn.1991-05.com.microsoft:hv-cinder-85920"; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904751Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6203224hv-cinder-85920S-1-5-189/26/2022 1:40:24 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {80FB8FF6-EEEC-43DA-8727-F7600DBAE4CD}; ClientMachine = HV-CINDER-85920; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4836; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1757447030; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904750Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6203224hv-cinder-85920S-1-5-189/26/2022 1:40:24 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {B6E729A7-BAD2-4402-A8F8-3F2236CC4B5F}; ClientMachine = HV-CINDER-85920; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4836; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=691392109; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904749Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6201836hv-cinder-85920S-1-5-189/26/2022 1:40:22 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {8001D94C-0D96-4A08-AAD6-5C0698A8F2A8}; ClientMachine = HV-CINDER-85920; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4836; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{BF5528D8-2185-4E43-A41B-04C4AC2D30EF}"; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904748Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6201836hv-cinder-85920S-1-5-189/26/2022 1:40:22 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {75D83E99-BC59-43F3-9084-E51EE38B6C23}; ClientMachine = HV-CINDER-85920; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4836; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1577976393; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904747Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6203224hv-cinder-85920S-1-5-189/26/2022 1:40:21 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
MSVSS__PROVIDER provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3160; ProviderPath = %systemroot%\system32\wbem\vsswmi.dll585700004611686018427387904746Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational31604812hv-cinder-85920S-1-5-209/26/2022 1:40:15 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {3F6320C5-746F-4815-A2DE-1E123D4520CF}; ClientMachine = HV-CINDER-85920; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4836; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Host.HostName="iqn.2010-10.org.openstack:volume-093dab0d-b36b-453c-ae06-3f0bdcaa2721"; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904745Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6201924hv-cinder-85920S-1-5-189/26/2022 1:40:08 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {1C6B5818-6745-46D3-BDD7-C1405CF843F0}; ClientMachine = HV-CINDER-85920; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4836; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_IDMethod.HostName="iqn.2010-10.org.openstack:volume-093dab0d-b36b-453c-ae06-3f0bdcaa2721",Method=4,Value="iqn.1991-05.com.microsoft:hv-cinder-85920"; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904744Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6201836hv-cinder-85920S-1-5-189/26/2022 1:40:08 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {B2DF07E1-52CC-4FB4-99A3-C5A264192D8C}; ClientMachine = HV-CINDER-85920; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4836; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{6F6EB492-927E-4D64-8E5F-8BBC3C4AD6C9}"; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904743Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6201608hv-cinder-85920S-1-5-189/26/2022 1:40:06 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {BE3F1307-227A-4F59-9B02-E5FCB7089837}; ClientMachine = HV-CINDER-85920; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4836; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=2031433724; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904742Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6201924hv-cinder-85920S-1-5-189/26/2022 1:40:05 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {62E375B9-55D2-4CFC-A259-37F102C8FB0D}; ClientMachine = HV-CINDER-85920; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4836; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{6B9C61BA-6450-4493-A5BC-EC2706C71363}"; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904741Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6201608hv-cinder-85920S-1-5-189/26/2022 1:40:05 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {5EADFDFD-9A64-4BE4-AE65-2E4E5ED586A8}; ClientMachine = HV-CINDER-85920; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4836; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{89394EDB-7B2F-419E-A19C-7D8ADEFBA45D}"; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904740Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6203224hv-cinder-85920S-1-5-189/26/2022 1:40:00 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
StorageWMI provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3160; ProviderPath = %SystemRoot%\System32\storagewmi.dll585700004611686018427387904739Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational31603332hv-cinder-85920S-1-5-209/26/2022 1:39:24 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {306DB1E1-11F7-4B6F-948F-250939BDEAAE}; ClientMachine = HV-CINDER-85920; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4836; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=550215391; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904738Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6201272hv-cinder-85920S-1-5-189/26/2022 1:39:20 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {0772B076-EEB9-479D-8827-C238FE5A0523}; ClientMachine = HV-CINDER-85920; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4836; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{34D0561B-C865-4BFD-B7B0-DA4A01DF9CC0}"; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904737Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6202804hv-cinder-85920S-1-5-189/26/2022 1:39:19 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {7497CCC9-B489-42E1-BEA4-6C5A3B83CBF4}; ClientMachine = HV-CINDER-85920; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4836; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{5C9E2CA0-46E7-4D8F-81D2-3C6A3C53C3C6}"; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904736Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6201144hv-cinder-85920S-1-5-189/26/2022 1:39:18 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {793D68AF-C149-49B7-A344-E84E9CB628DC}; ClientMachine = HV-CINDER-85920; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4836; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{618D2178-5418-4DB9-8B70-7626A1E5A3B5}"; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904735Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6201304hv-cinder-85920S-1-5-189/26/2022 1:39:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {1742AA9B-0C44-4442-99DA-0552676A5301}; ClientMachine = HV-CINDER-85920; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4836; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{80188613-A4CE-4126-81FC-5A13026E8572}"; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904734Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6201836hv-cinder-85920S-1-5-189/26/2022 1:39:02 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {63803141-AD67-42BE-9E7A-EAA16EF28851}; ClientMachine = HV-CINDER-85920; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4836; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1518554368; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904733Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6201836hv-cinder-85920S-1-5-189/26/2022 1:38:58 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {366AE802-5DC8-47BF-AD51-A05136F8E312}; ClientMachine = HV-CINDER-85920; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4836; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1848181202; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904732Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6201304hv-cinder-85920S-1-5-189/26/2022 1:38:57 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {3F38D30B-9079-406D-BA47-57D963637B95}; ClientMachine = HV-CINDER-85920; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4836; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{CB6DFED6-7B34-4DA7-A541-582F6D98D4CD}"; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904731Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6202804hv-cinder-85920S-1-5-189/26/2022 1:38:55 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {608AE759-1F76-485B-B26E-A840ADA89AE7}; ClientMachine = HV-CINDER-85920; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4836; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Host.HostName="iqn.2010-10.org.openstack:volume-60164cca-b7f7-4637-b7e5-497c9d291d57"; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904730Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6204556hv-cinder-85920S-1-5-189/26/2022 1:38:43 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {5C69FC6D-7B25-4664-A136-5FC76A4D1809}; ClientMachine = HV-CINDER-85920; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4836; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_IDMethod.HostName="iqn.2010-10.org.openstack:volume-60164cca-b7f7-4637-b7e5-497c9d291d57",Method=4,Value="iqn.1991-05.com.microsoft:hv-cinder-85920"; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904729Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6202804hv-cinder-85920S-1-5-189/26/2022 1:38:43 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {79B054EF-55BF-4453-833F-8BA678B8D026}; ClientMachine = HV-CINDER-85920; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4836; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{E55FA503-C1D0-46A0-B78E-229936BE64F1}"; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904728Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6203108hv-cinder-85920S-1-5-189/26/2022 1:38:36 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {ED79C544-FED9-47FB-9402-4C52738B1E31}; ClientMachine = HV-CINDER-85920; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4836; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{0EE28D9E-90B3-4FAC-973B-67579CC21C8A}"; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904727Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6203108hv-cinder-85920S-1-5-189/26/2022 1:38:35 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {C33EF634-C893-49D2-8307-242958770853}; ClientMachine = HV-CINDER-85920; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4836; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=247304994; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904726Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6202484hv-cinder-85920S-1-5-189/26/2022 1:38:34 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {71D6BD94-D42D-4E21-9617-5FEB70047878}; ClientMachine = HV-CINDER-85920; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4836; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{125879B8-83FA-4460-A4F7-1361031C324B}"; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904725Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6202484hv-cinder-85920S-1-5-189/26/2022 1:38:34 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {898E2783-C54F-4336-AA26-A3EFF9E5DF48}; ClientMachine = HV-CINDER-85920; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4836; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=646441993; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904724Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6201272hv-cinder-85920S-1-5-189/26/2022 1:38:11 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {20BCFB87-E1C5-4CE2-A283-EEF8536E6F0B}; ClientMachine = HV-CINDER-85920; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4836; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1207078164; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904723Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6203108hv-cinder-85920S-1-5-189/26/2022 1:38:10 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {8E66980D-94EC-49F5-9736-F34E3E60B0DA}; ClientMachine = HV-CINDER-85920; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4836; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1608651585; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904722Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6201272hv-cinder-85920S-1-5-189/26/2022 1:38:10 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {A09660ED-DCA0-4580-AAAE-DC5E71EDC2EF}; ClientMachine = HV-CINDER-85920; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4836; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=852956292; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904721Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6201272hv-cinder-85920S-1-5-189/26/2022 1:38:09 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9432E6F1-6945-46F7-B885-AF73F9F94AC0}; ClientMachine = HV-CINDER-85920; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4836; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=2135236406; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904720Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6201304hv-cinder-85920S-1-5-189/26/2022 1:38:09 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {67566B2F-FE5E-40CE-87BF-152D36A9B00E}; ClientMachine = HV-CINDER-85920; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4836; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=413230513; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904719Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6201272hv-cinder-85920S-1-5-189/26/2022 1:38:08 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {3F7A7291-B9DF-41C6-8CEF-26F69BD046B2}; ClientMachine = HV-CINDER-85920; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4836; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=720326284; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904718Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6201304hv-cinder-85920S-1-5-189/26/2022 1:38:07 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {64D4E3F0-03FF-4DF0-AA35-1FE7888BCAAB}; ClientMachine = HV-CINDER-85920; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4836; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=486154371; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904717Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6201272hv-cinder-85920S-1-5-189/26/2022 1:38:07 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {1C33690A-16FE-49C3-92D8-7A09CE8C7D27}; ClientMachine = HV-CINDER-85920; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4836; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=909559126; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904716Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6201272hv-cinder-85920S-1-5-189/26/2022 1:38:06 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {6F96F88C-C881-4412-9772-C38D6AD624C3}; ClientMachine = HV-CINDER-85920; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4836; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=289454050; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904715Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6201272hv-cinder-85920S-1-5-189/26/2022 1:38:06 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {49330385-4907-4E31-AD2A-66824776CE69}; ClientMachine = HV-CINDER-85920; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4836; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{582EA594-2CE2-4F60-8C7B-54A248744147}"; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904714Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6201304hv-cinder-85920S-1-5-189/26/2022 1:38:06 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {3692FE30-D7EB-4CA2-8377-DEC4B2220E29}; ClientMachine = HV-CINDER-85920; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4836; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1869180928; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904713Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6201304hv-cinder-85920S-1-5-189/26/2022 1:38:05 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {6D5EEFB3-3221-4A12-AD23-B8A632BFA303}; ClientMachine = HV-CINDER-85920; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4836; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1862577706; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904712Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6201608hv-cinder-85920S-1-5-189/26/2022 1:37:59 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FF9DD435-DA7A-4E10-8D6E-E984E12E3084}; ClientMachine = HV-CINDER-85920; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4836; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{E77A02A3-E682-4874-AB33-582BF26A7075}"; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904711Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6201608hv-cinder-85920S-1-5-189/26/2022 1:37:59 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {60F29F32-50BD-44BD-A438-6DB89936516B}; ClientMachine = HV-CINDER-85920; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4836; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=786793796; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904710Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6201924hv-cinder-85920S-1-5-189/26/2022 1:37:58 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {8A5E09BA-1395-4813-B22F-FA77654DF3D7}; ClientMachine = HV-CINDER-85920; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4836; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=450775946; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904709Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6203108hv-cinder-85920S-1-5-189/26/2022 1:37:58 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {F706B1AD-5035-4921-AE6D-C9E4A955B2A1}; ClientMachine = HV-CINDER-85920; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4836; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1150482813; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904708Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6201144hv-cinder-85920S-1-5-189/26/2022 1:37:53 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {C323FC5A-D40D-4FC2-8A9E-B4F90A2BDC4E}; ClientMachine = HV-CINDER-85920; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4836; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=203324590; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904707Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6201608hv-cinder-85920S-1-5-189/26/2022 1:37:52 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {77402D63-A9BF-4282-9B6A-0C7F018356F8}; ClientMachine = HV-CINDER-85920; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4836; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=204644314; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904706Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6203108hv-cinder-85920S-1-5-189/26/2022 1:37:45 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {56388D39-AE3A-4D35-B23D-4EE28C731B8C}; ClientMachine = HV-CINDER-85920; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4836; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=583469453; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904705Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6201144hv-cinder-85920S-1-5-189/26/2022 1:37:44 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {8E560062-9273-45B3-BEC3-B133899A4C1B}; ClientMachine = HV-CINDER-85920; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4836; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{4CB02953-E808-4713-A6A3-9F75F7A359FB}"; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904704Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6203108hv-cinder-85920S-1-5-189/26/2022 1:37:43 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {7D4B1933-298A-468D-ACB5-61453C948CDF}; ClientMachine = HV-CINDER-85920; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4836; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1952746565; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904703Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6203108hv-cinder-85920S-1-5-189/26/2022 1:37:42 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {5522612C-1B7B-442E-876B-73F089814770}; ClientMachine = HV-CINDER-85920; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4836; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=51644095; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904702Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6201924hv-cinder-85920S-1-5-189/26/2022 1:37:40 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {4D89D1E9-FF69-44C8-BAC3-AE8D6B419AB9}; ClientMachine = HV-CINDER-85920; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4836; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1726053557; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904701Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6201608hv-cinder-85920S-1-5-189/26/2022 1:37:40 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {6F3C9DE7-62A4-4BB3-80C4-43BFB4B02852}; ClientMachine = HV-CINDER-85920; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4836; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1884407851; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904700Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6201608hv-cinder-85920S-1-5-189/26/2022 1:37:36 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {170EFA36-A6DA-4C9B-85AE-F18F295D7D83}; ClientMachine = HV-CINDER-85920; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4836; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1046744345; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904699Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6201608hv-cinder-85920S-1-5-189/26/2022 1:37:34 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {CA4620D3-88EE-4D71-8676-20FAFB449FE9}; ClientMachine = HV-CINDER-85920; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4836; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{90B2797C-9443-4B58-BAF8-CB152C6644EF}"; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904698Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6202484hv-cinder-85920S-1-5-189/26/2022 1:37:34 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {3A878F26-465B-4408-AEFE-9ECA66963C71}; ClientMachine = HV-CINDER-85920; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4836; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{33BA401E-6548-49A0-B1E3-DF6B161BAE0C}"; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904697Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6201608hv-cinder-85920S-1-5-189/26/2022 1:37:34 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {D0734F12-4780-4536-9B8D-0D2C1C17A8B5}; ClientMachine = HV-CINDER-85920; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4836; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Host.HostName="iqn.2010-10.org.openstack:volume-87f682dc-7d3e-47a2-802d-3dc7364702b7"; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904696Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6201144hv-cinder-85920S-1-5-189/26/2022 1:37:33 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {85BECFB9-A848-4458-89AB-D81569BD91C8}; ClientMachine = HV-CINDER-85920; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4836; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_IDMethod.HostName="iqn.2010-10.org.openstack:volume-87f682dc-7d3e-47a2-802d-3dc7364702b7",Method=4,Value="iqn.1991-05.com.microsoft:hv-cinder-85920"; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904695Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6201144hv-cinder-85920S-1-5-189/26/2022 1:37:33 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {AAD9024D-6FE1-4A38-B5D9-3252A2002F68}; ClientMachine = HV-CINDER-85920; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4836; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=2069005350; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904694Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6201836hv-cinder-85920S-1-5-189/26/2022 1:37:24 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {974F5CCF-D9AF-4535-9E6B-0DC664449393}; ClientMachine = HV-CINDER-85920; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4836; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=789436212; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904693Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6201836hv-cinder-85920S-1-5-189/26/2022 1:37:21 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
StorageWMI provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3160; ProviderPath = %SystemRoot%\System32\storagewmi.dll585700004611686018427387904692Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational31603332hv-cinder-85920S-1-5-209/26/2022 1:37:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {C37789D6-103B-4C4B-B158-33A8259B0E71}; ClientMachine = HV-CINDER-85920; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4836; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=253457620; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904691Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6202804hv-cinder-85920S-1-5-189/26/2022 1:37:12 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {A2CF7E01-8B29-4C89-8643-E0CC54154FB8}; ClientMachine = HV-CINDER-85920; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4836; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=588413734; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904690Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6201836hv-cinder-85920S-1-5-189/26/2022 1:37:11 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {E8442794-020D-4489-B1CE-FAFB3E9C5A28}; ClientMachine = HV-CINDER-85920; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4836; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=658904089; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904689Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational620664hv-cinder-85920S-1-5-189/26/2022 1:37:11 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {7768CD27-AC82-4EA7-AFE7-1201C1A71DAB}; ClientMachine = HV-CINDER-85920; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4836; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{0C785033-462B-436C-8218-683BA0792432}"; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904688Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6201608hv-cinder-85920S-1-5-189/26/2022 1:37:10 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {8CADEE5D-1A25-4979-A326-09F124EEB92F}; ClientMachine = HV-CINDER-85920; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4836; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1822183496; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904687Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6202804hv-cinder-85920S-1-5-189/26/2022 1:37:10 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {3133D353-918A-4AC8-9FF6-E73E1C8BB513}; ClientMachine = HV-CINDER-85920; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4836; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1909881339; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904686Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6201836hv-cinder-85920S-1-5-189/26/2022 1:37:09 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {983CF826-9117-4358-B629-A18D5161792A}; ClientMachine = HV-CINDER-85920; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4836; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{CBE1FBC0-B6DE-486D-A47A-AA135EAA6036}"; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904685Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6201272hv-cinder-85920S-1-5-189/26/2022 1:37:06 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {BB7003AB-C306-4318-8A19-756F9B643989}; ClientMachine = HV-CINDER-85920; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4836; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=843659561; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904684Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6201304hv-cinder-85920S-1-5-189/26/2022 1:37:01 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {72E8B1BB-CB90-4CB0-BD4A-1AB1BE06F32B}; ClientMachine = HV-CINDER-85920; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4836; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=140337845; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904683Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6201924hv-cinder-85920S-1-5-189/26/2022 1:36:57 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {3F731080-BFEF-462E-AE4D-BCE224219E98}; ClientMachine = HV-CINDER-85920; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4836; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1800523253; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904682Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6201304hv-cinder-85920S-1-5-189/26/2022 1:36:57 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {E83C37AF-F330-49E8-906F-42C32F8F648C}; ClientMachine = HV-CINDER-85920; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4836; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=269051299; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904681Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6201924hv-cinder-85920S-1-5-189/26/2022 1:36:56 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {B7CAEFB5-C6BB-467B-9841-0B0C547BD84C}; ClientMachine = HV-CINDER-85920; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4836; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{A56509B9-07A1-4048-9396-C66902BC7E84}"; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904680Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6202804hv-cinder-85920S-1-5-189/26/2022 1:36:56 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {0CFC0209-C48D-4FB8-A79D-96A527C17179}; ClientMachine = HV-CINDER-85920; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4836; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{F37116C2-DE17-4558-ABF6-29469BEEF577}"; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904679Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6202804hv-cinder-85920S-1-5-189/26/2022 1:36:56 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {6E3160F2-A6BC-4B98-A510-A2FF81A0DE6E}; ClientMachine = HV-CINDER-85920; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4836; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1241884132; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904678Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6201924hv-cinder-85920S-1-5-189/26/2022 1:36:55 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {D14E370B-24CA-404E-9C59-ADD93782E3E0}; ClientMachine = HV-CINDER-85920; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4836; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1552688895; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904677Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6201836hv-cinder-85920S-1-5-189/26/2022 1:36:54 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {7CB143DC-4CE3-4826-97FA-AB2E34711518}; ClientMachine = HV-CINDER-85920; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4836; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{65C5B312-2147-46B2-99DE-E7B831202A85}"; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904676Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6201836hv-cinder-85920S-1-5-189/26/2022 1:36:47 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {4F179CDC-BDFB-497C-8B0E-68F78AEAAE06}; ClientMachine = HV-CINDER-85920; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4836; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1305613844; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904675Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6201836hv-cinder-85920S-1-5-189/26/2022 1:36:47 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {CA90AD4D-B5F5-445B-9F35-DFCA50EB22E4}; ClientMachine = HV-CINDER-85920; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4836; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1379722926; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904674Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6201924hv-cinder-85920S-1-5-189/26/2022 1:36:41 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD9613AF-EA1C-43AC-A090-1F13330629C8}; ClientMachine = HV-CINDER-85920; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4836; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=520631572; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904673Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6201924hv-cinder-85920S-1-5-189/26/2022 1:36:40 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD1C971A-FB50-4A88-91C5-2C851CB71C52}; ClientMachine = HV-CINDER-85920; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4836; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{7505DE09-9584-4515-B9F7-6FD42628FB04}"; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904672Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6201272hv-cinder-85920S-1-5-189/26/2022 1:36:37 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {09B27F13-C560-4711-B74C-18586BAB6D49}; ClientMachine = HV-CINDER-85920; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4836; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=436909689; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904671Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6202804hv-cinder-85920S-1-5-189/26/2022 1:36:36 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {F95D64C9-0FE5-4C1A-BB87-AE75C906F8E9}; ClientMachine = HV-CINDER-85920; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4836; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1886779921; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904670Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6202804hv-cinder-85920S-1-5-189/26/2022 1:36:36 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {22873855-A404-4578-900C-F9C4F3EDB495}; ClientMachine = HV-CINDER-85920; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4836; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{595B725F-0F97-460F-990B-FE8D7D1E751D}"; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904669Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6201144hv-cinder-85920S-1-5-189/26/2022 1:36:32 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {BA36D02E-D881-46DA-829D-AA799C1799CA}; ClientMachine = HV-CINDER-85920; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4836; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1238171449; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904668Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6201608hv-cinder-85920S-1-5-189/26/2022 1:36:31 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {4E71A763-D387-47A7-ACD4-5FC4779FA4E7}; ClientMachine = HV-CINDER-85920; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4836; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=291595467; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904667Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6201924hv-cinder-85920S-1-5-189/26/2022 1:36:30 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {8E9DDE2F-322D-47C7-A5E2-913A3E083200}; ClientMachine = HV-CINDER-85920; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4836; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=178446469; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904666Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6201272hv-cinder-85920S-1-5-189/26/2022 1:36:29 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {450460F4-5050-4686-A4D1-4C49183DEC27}; ClientMachine = HV-CINDER-85920; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4836; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=448846695; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904665Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6201836hv-cinder-85920S-1-5-189/26/2022 1:36:11 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {E2821CF2-D34F-4109-9903-0291CE9A30B4}; ClientMachine = HV-CINDER-85920; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4836; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{42FF3E75-C380-473A-9C5F-E68B4C259F3C}"; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904664Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6201608hv-cinder-85920S-1-5-189/26/2022 1:36:10 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
MSVSS__PROVIDER provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3160; ProviderPath = %systemroot%\system32\wbem\vsswmi.dll585700004611686018427387904663Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational3160376hv-cinder-85920S-1-5-209/26/2022 1:36:04 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32a provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3160; ProviderPath = %systemroot%\system32\wbem\wmipcima.dll585700004611686018427387904662Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational31603332hv-cinder-85920S-1-5-209/26/2022 1:36:04 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WinTargetProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 5076; ProviderPath = C:\windows\system32\wbem\WTWMIProv.dll585700004611686018427387904661Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational50762136hv-cinder-85920S-1-5-199/26/2022 1:36:04 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Namespace = root\virtualization\v2; NotificationQuery = SELECT * FROM __InstanceDeletionEvent WITHIN 2 WHERE TargetInstance ISA 'Msvm_SyntheticEthernetPortSettingData' ; UserName = NT AUTHORITY\SYSTEM; ClientProcessID = 4224, ClientMachine = HV-CINDER-85920; PossibleCause = Temporary586000004611686018427387904660Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6205092hv-cinder-85920S-1-5-189/26/2022 1:34:12 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Namespace = root\virtualization\v2; NotificationQuery = SELECT * FROM __InstanceCreationEvent WITHIN 2 WHERE TargetInstance ISA 'Msvm_SyntheticEthernetPortSettingData' ; UserName = NT AUTHORITY\SYSTEM; ClientProcessID = 4224, ClientMachine = HV-CINDER-85920; PossibleCause = Temporary586000004611686018427387904659Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6205092hv-cinder-85920S-1-5-189/26/2022 1:34:12 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Namespace = root\virtualization\v2; NotificationQuery = SELECT EnabledState, TargetInstance FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA 'Msvm_ComputerSystem' AND TargetInstance.EnabledState != PreviousInstance.EnabledState AND (TargetInstance.EnabledState = '2' OR TargetInstance.EnabledState = '3' OR TargetInstance.EnabledState = '32768' OR TargetInstance.EnabledState = '32769'); UserName = NT AUTHORITY\SYSTEM; ClientProcessID = 2264, ClientMachine = HV-CINDER-85920; PossibleCause = Temporary586000004611686018427387904658Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6205092hv-cinder-85920S-1-5-189/26/2022 1:34:10 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WinTargetProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3628; ProviderPath = C:\windows\system32\wbem\WTWMIProv.dll585700004611686018427387904657Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational36282988hv-cinder-85920S-1-5-199/26/2022 1:34:07 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WMIProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4932; ProviderPath = %systemroot%\system32\wbem\wmiprov.dll585700004611686018427387904656Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational49321400hv-cinder-85920S-1-5-189/26/2022 1:34:07 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Win32_WIN32_TERMINALSERVICE_Prov provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3160; ProviderPath = %SystemRoot%\system32\tscfgwmi.dll585700004611686018427387904655Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational31603332hv-cinder-85920S-1-5-209/26/2022 1:33:53 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 5008; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll585700004611686018427387904654Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational50081960hv-cinder-85920S-1-5-189/26/2022 1:33:43 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3160; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll585700004611686018427387904653Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational31603332hv-cinder-85920S-1-5-209/26/2022 1:33:43 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3160; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll585700004611686018427387904652Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational31603332hv-cinder-85920S-1-5-209/26/2022 1:33:42 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WMIProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1644; ProviderPath = %systemroot%\system32\wbem\wmiprov.dll585700004611686018427387904651Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational16441560hv-cinder-85920S-1-5-189/26/2022 1:22:27 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32a provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4564; ProviderPath = %systemroot%\system32\wbem\wmipcima.dll585700004611686018427387904650Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational45644960hv-cinder-85920S-1-5-209/26/2022 1:21:27 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Win32_WIN32_TERMINALSERVICE_Prov provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4564; ProviderPath = %SystemRoot%\system32\tscfgwmi.dll585700004611686018427387904649Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational45643292hv-cinder-85920S-1-5-209/26/2022 1:21:26 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4564; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll585700004611686018427387904648Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational45644960hv-cinder-85920S-1-5-209/26/2022 1:21:26 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
MSIProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3620; ProviderPath = %systemroot%\system32\wbem\msiprov.dll585700004611686018427387904647Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational36203644hv-cinder-85920S-1-5-189/26/2022 1:04:57 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {3435374A-D143-0005-033A-353443D1D801}; ClientMachine = HV-CINDER-85920; User = HV-CINDER-85920\Admin; ClientProcessId = 3252; Component = Core; Operation = Start IWbemServices::ExecNotificationQuery - root\virtualization\v2 : SELECT * FROM __InstanceDeletionEvent WITHIN 2 WHERE TargetInstance ISA 'Msvm_ConcreteJob'; ResultCode = 0x800706BE; PossibleCause = Could not send status to client585802004611686018427387904646Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6203696hv-cinder-85920S-1-5-189/26/2022 1:01:54 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {3435374A-D143-0005-033A-353443D1D801}; ClientMachine = HV-CINDER-85920; User = HV-CINDER-85920\Admin; ClientProcessId = 3252; Component = Unknown; Operation = Start IWbemServices::ExecNotificationQuery - root\virtualization\v2 : SELECT * FROM __InstanceDeletionEvent WITHIN 2 WHERE TargetInstance ISA 'Msvm_ConcreteJob'; ResultCode = 0x80041032; PossibleCause = Unknown585802004611686018427387904645Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6203952hv-cinder-85920S-1-5-189/26/2022 1:01:54 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {3435374A-D143-0005-033A-353443D1D801}; ClientMachine = HV-CINDER-85920; User = HV-CINDER-85920\Admin; ClientProcessId = 3252; Component = Unknown; Operation = Start IWbemServices::ExecNotificationQuery - root\virtualization\v2 : SELECT * FROM __InstanceModificationEvent WITHIN 2 WHERE TargetInstance ISA 'Msvm_ConcreteJob'; ResultCode = 0x80041032; PossibleCause = Unknown585802004611686018427387904644Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6203952hv-cinder-85920S-1-5-189/26/2022 1:01:53 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Namespace = root\virtualization\v2; NotificationQuery = SELECT * FROM __InstanceDeletionEvent WITHIN 2 WHERE TargetInstance ISA 'Msvm_ConcreteJob'; UserName = HV-CINDER-85920\Admin; ClientProcessID = 3252, ClientMachine = HV-CINDER-85920; PossibleCause = Temporary586000004611686018427387904643Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6203952hv-cinder-85920S-1-5-189/26/2022 1:01:53 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Namespace = root\virtualization\v2; NotificationQuery = SELECT * FROM __InstanceModificationEvent WITHIN 2 WHERE TargetInstance ISA 'Msvm_ConcreteJob'; UserName = HV-CINDER-85920\Admin; ClientProcessID = 3252, ClientMachine = HV-CINDER-85920; PossibleCause = Temporary586000004611686018427387904642Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6203952hv-cinder-85920S-1-5-189/26/2022 1:01:53 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NetAdapterCim provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 916; ProviderPath = %systemroot%\system32\wbem\NetAdapterCim.dll585700004611686018427387904641Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9162984hv-cinder-85920S-1-5-199/26/2022 1:01:52 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
nettcpip provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2400; ProviderPath = %systemroot%\system32\wbem\NetTCPIP.dll585700004611686018427387904640Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational24002800hv-cinder-85920S-1-5-209/26/2022 1:01:50 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
MSiSCSITargetProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3192; ProviderPath = C:\windows\system32\wbem\SmIscsiTargetProv.dll585700004611686018427387904639Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational3192584hv-cinder-85920S-1-5-209/26/2022 1:01:49 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WinTargetProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 876; ProviderPath = C:\windows\system32\wbem\WTWMIProv.dll585700004611686018427387904638Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational8763940hv-cinder-85920S-1-5-199/26/2022 1:01:48 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WMIProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3620; ProviderPath = %systemroot%\system32\wbem\wmiprov.dll585700004611686018427387904637Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational36203648hv-cinder-85920S-1-5-189/26/2022 1:01:48 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
MSiSCSITargetProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3192; ProviderPath = C:\windows\system32\wbem\SmIscsiTargetProv.dll585700004611686018427387904636Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational31922220hv-cinder-85920S-1-5-209/26/2022 1:01:48 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Win32_WIN32_TERMINALSERVICE_Prov provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2400; ProviderPath = %SystemRoot%\system32\tscfgwmi.dll585700004611686018427387904635Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational24002540hv-cinder-85920S-1-5-209/26/2022 1:01:37 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
wfascim provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2400; ProviderPath = %systemroot%\system32\wbem\wfascim.dll585700004611686018427387904634Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational24002800hv-cinder-85920S-1-5-209/26/2022 1:01:34 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3204; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll585700004611686018427387904633Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational32043248hv-cinder-85920S-1-5-189/26/2022 1:01:01 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2400; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll585700004611686018427387904632Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational24002540hv-cinder-85920S-1-5-209/26/2022 1:01:01 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2400; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll585700004611686018427387904631Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational24002540hv-cinder-85920S-1-5-209/26/2022 1:00:55 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = HV-CINDER-85920; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1396; Component = Unknown; Operation = Start IWbemServices::CreateInstanceEnum - root\wmi : MSiSCSI_PortalInfoClass; ResultCode = 0x8004100C; PossibleCause = Unknown585802004611686018427387904630Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6203264hv-cinder-85920S-1-5-189/26/2022 1:00:27 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = HV-CINDER-85920; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1396; Component = Unknown; Operation = Start IWbemServices::CreateInstanceEnum - root\wmi : MS_SM_AdapterInformationQuery; ResultCode = 0x8004100C; PossibleCause = Unknown585802004611686018427387904629Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6203264hv-cinder-85920S-1-5-189/26/2022 1:00:27 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
wmiprov provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3620; ProviderPath = %systemroot%\system32\wbem\wmiprov.dll585700004611686018427387904628Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational36203648hv-cinder-85920S-1-5-189/26/2022 1:00:27 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = HV-CINDER-85920; User = HV-CINDER-85920\cloudbase-init; ClientProcessId = 2964; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\cimv2 : SELECT RemainingWindowsReArmCount, KeyManagementServiceListeningPort, KeyManagementServiceDnsPublishing, KeyManagementServiceLowPriority, ClientMachineId, KeyManagementServiceHostCaching, Version FROM SoftwareLicensingService; ResultCode = 0x80041032; PossibleCause = Unknown585802004611686018427387904627Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6203024hv-cinder-85920S-1-5-189/26/2022 1:00:24 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
SppProvider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2400; ProviderPath = %SystemRoot%\System32\sppwmi.dll585700004611686018427387904626Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational24002540hv-cinder-85920S-1-5-209/26/2022 1:00:24 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = HV-CINDER-85920; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3152; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\Microsoft\Windows\DeviceGuard : SELECT AvailableSecurityProperties FROM Win32_DeviceGuard ; ResultCode = 0x80041032; PossibleCause = Unknown585802004611686018427387904625Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6203024hv-cinder-85920S-1-5-189/26/2022 1:00:07 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = HV-CINDER-85920; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3152; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\Microsoft\Windows\DeviceGuard : SELECT RequiredSecurityProperties FROM Win32_DeviceGuard ; ResultCode = 0x80041032; PossibleCause = Unknown585802004611686018427387904624Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6203040hv-cinder-85920S-1-5-189/26/2022 1:00:07 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = HV-CINDER-85920; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3152; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\Microsoft\Windows\DeviceGuard : SELECT SecurityServicesConfigured FROM Win32_DeviceGuard ; ResultCode = 0x80041032; PossibleCause = Unknown585802004611686018427387904623Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6203040hv-cinder-85920S-1-5-189/26/2022 1:00:07 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Win32_TpmProvider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2400; ProviderPath = C:\Windows\system32\wbem\Win32_TPM.dll585700004611686018427387904622Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational24002800hv-cinder-85920S-1-5-209/26/2022 1:00:07 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = HV-CINDER-85920; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3152; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\Microsoft\Windows\DeviceGuard : SELECT VirtualizationBasedSecurityStatus FROM Win32_DeviceGuard ; ResultCode = 0x80041032; PossibleCause = Unknown585802004611686018427387904621Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6202760hv-cinder-85920S-1-5-189/26/2022 1:00:07 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = HV-CINDER-85920; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3152; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\Microsoft\Windows\DeviceGuard : SELECT RequiredSecurityProperties FROM Win32_DeviceGuard ; ResultCode = 0x80041032; PossibleCause = Unknown585802004611686018427387904620Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6203024hv-cinder-85920S-1-5-189/26/2022 1:00:07 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = HV-CINDER-85920; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3152; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\Microsoft\Windows\DeviceGuard : SELECT VirtualizationBasedSecurityStatus FROM Win32_DeviceGuard ; ResultCode = 0x80041032; PossibleCause = Unknown585802004611686018427387904619Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6202784hv-cinder-85920S-1-5-189/26/2022 1:00:07 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = HV-CINDER-85920; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3152; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\Microsoft\Windows\DeviceGuard : SELECT SecurityServicesRunning FROM Win32_DeviceGuard ; ResultCode = 0x80041032; PossibleCause = Unknown585802004611686018427387904618Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6203024hv-cinder-85920S-1-5-189/26/2022 1:00:07 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = HV-CINDER-85920; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3152; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\Microsoft\Windows\DeviceGuard : SELECT SecurityServicesRunning FROM Win32_DeviceGuard ; ResultCode = 0x80041032; PossibleCause = Unknown585802004611686018427387904617Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6202784hv-cinder-85920S-1-5-189/26/2022 1:00:07 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Win32_DeviceGuard provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2400; ProviderPath = %SystemRoot%\System32\Win32_DeviceGuard.dll585700004611686018427387904616Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational24002800hv-cinder-85920S-1-5-209/26/2022 1:00:07 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = HV-CINDER-85920; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3152; Component = Unknown; Operation = Start IWbemServices::ExecQuery - ROOT\CIMV2 : select ChassisTypes from Win32_SystemEnclosure; ResultCode = 0x80041032; PossibleCause = Unknown585802004611686018427387904615Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6203024hv-cinder-85920S-1-5-189/26/2022 1:00:06 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = HV-CINDER-85920; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3152; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\CIMV2 : SELECT SMBIOSAssetTag FROM Win32_SystemEnclosure ; ResultCode = 0x80041032; PossibleCause = Unknown585802004611686018427387904614Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6202784hv-cinder-85920S-1-5-189/26/2022 1:00:06 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = HV-CINDER-85920; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3152; Component = Unknown; Operation = Start IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT ID FROM Win32_ServerFeature; ResultCode = 0x80041032; PossibleCause = Unknown585802004611686018427387904613Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6202760hv-cinder-85920S-1-5-189/26/2022 1:00:05 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3204; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll585700004611686018427387904612Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational32043592hv-cinder-85920S-1-5-189/26/2022 1:00:00 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
ServerFeatureProvider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2400; ProviderPath = %windir%\system32\wbem\servercompprov.dll585700004611686018427387904611Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational24002540hv-cinder-85920S-1-5-209/26/2022 1:00:00 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {A4A1F96B-A9C9-4F57-AB24-DEA5AFCAA06C}; ClientMachine = HV-CINDER-85920; User = ; ClientProcessId = 620; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{FC491EF1-C4AA-4CE1-B329-414B101DB823}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904610Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6202332hv-cinder-85920S-1-5-189/26/2022 12:59:52 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {A4A1F96B-A9C9-4F57-AB24-DEA5AFCAA06C}; ClientMachine = HV-CINDER-85920; User = ; ClientProcessId = 620; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{fbf687e6-f063-4d9f-9f4f-fd9a26acdd5f}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904609Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6202332hv-cinder-85920S-1-5-189/26/2022 12:59:52 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {A4A1F96B-A9C9-4F57-AB24-DEA5AFCAA06C}; ClientMachine = HV-CINDER-85920; User = ; ClientProcessId = 620; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{FB2CA36D-0B40-4307-821B-A13B252DE56C}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904608Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6202332hv-cinder-85920S-1-5-189/26/2022 12:59:51 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {A4A1F96B-A9C9-4F57-AB24-DEA5AFCAA06C}; ClientMachine = HV-CINDER-85920; User = ; ClientProcessId = 620; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{f3ccc681-b74c-4060-9f26-cd84525dca2a}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904607Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6202332hv-cinder-85920S-1-5-189/26/2022 12:59:51 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {A4A1F96B-A9C9-4F57-AB24-DEA5AFCAA06C}; ClientMachine = HV-CINDER-85920; User = ; ClientProcessId = 620; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{F312195E-3D9D-447A-A3F5-08DFFA24735E}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904606Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6202332hv-cinder-85920S-1-5-189/26/2022 12:59:51 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {A4A1F96B-A9C9-4F57-AB24-DEA5AFCAA06C}; ClientMachine = HV-CINDER-85920; User = ; ClientProcessId = 620; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{E62688F0-25FD-4c90-BFF5-F508B9D2E31F}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904605Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6202332hv-cinder-85920S-1-5-189/26/2022 12:59:51 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {A4A1F96B-A9C9-4F57-AB24-DEA5AFCAA06C}; ClientMachine = HV-CINDER-85920; User = ; ClientProcessId = 620; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{E5094040-C46C-4115-B030-04FB2E545B00}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904604Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6202332hv-cinder-85920S-1-5-189/26/2022 12:59:51 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {A4A1F96B-A9C9-4F57-AB24-DEA5AFCAA06C}; ClientMachine = HV-CINDER-85920; User = ; ClientProcessId = 620; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{E4F48E54-F38D-4884-BFB9-D4D2E5729C18}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904603Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6202332hv-cinder-85920S-1-5-189/26/2022 12:59:51 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {A4A1F96B-A9C9-4F57-AB24-DEA5AFCAA06C}; ClientMachine = HV-CINDER-85920; User = ; ClientProcessId = 620; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{e437bc1c-aa7d-11d2-a382-00c04f991e27}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904602Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6202332hv-cinder-85920S-1-5-189/26/2022 12:59:51 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {A4A1F96B-A9C9-4F57-AB24-DEA5AFCAA06C}; ClientMachine = HV-CINDER-85920; User = ; ClientProcessId = 620; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{CF7639F3-ABA2-41DB-97F2-81E2C5DBFC5D}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904601Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6202332hv-cinder-85920S-1-5-189/26/2022 12:59:51 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {A4A1F96B-A9C9-4F57-AB24-DEA5AFCAA06C}; ClientMachine = HV-CINDER-85920; User = ; ClientProcessId = 620; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{cdeafc3d-948d-49dd-ab12-e578ba4af7aa}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904600Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6202332hv-cinder-85920S-1-5-189/26/2022 12:59:51 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {A4A1F96B-A9C9-4F57-AB24-DEA5AFCAA06C}; ClientMachine = HV-CINDER-85920; User = ; ClientProcessId = 620; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{c6dc5466-785a-11d2-84d0-00c04fb169f7}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904599Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6202332hv-cinder-85920S-1-5-189/26/2022 12:59:51 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {A4A1F96B-A9C9-4F57-AB24-DEA5AFCAA06C}; ClientMachine = HV-CINDER-85920; User = ; ClientProcessId = 620; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{C631DF4C-088F-4156-B058-4375F0853CD8}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904598Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6202332hv-cinder-85920S-1-5-189/26/2022 12:59:51 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {A4A1F96B-A9C9-4F57-AB24-DEA5AFCAA06C}; ClientMachine = HV-CINDER-85920; User = ; ClientProcessId = 620; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{C418DD9D-0D14-4efb-8FBF-CFE535C8FAC7}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904597Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6202332hv-cinder-85920S-1-5-189/26/2022 12:59:51 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {A4A1F96B-A9C9-4F57-AB24-DEA5AFCAA06C}; ClientMachine = HV-CINDER-85920; User = ; ClientProcessId = 620; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{C34B2751-1CF4-44F5-9262-C3FC39666591}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904596Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6202332hv-cinder-85920S-1-5-189/26/2022 12:59:51 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {A4A1F96B-A9C9-4F57-AB24-DEA5AFCAA06C}; ClientMachine = HV-CINDER-85920; User = ; ClientProcessId = 620; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{BC75B1ED-5833-4858-9BB8-CBF0B166DF9D}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904595Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6202332hv-cinder-85920S-1-5-189/26/2022 12:59:51 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {A4A1F96B-A9C9-4F57-AB24-DEA5AFCAA06C}; ClientMachine = HV-CINDER-85920; User = ; ClientProcessId = 620; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{BA649533-0AAC-4E04-B9BC-4DBAE0325B12}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904594Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6202332hv-cinder-85920S-1-5-189/26/2022 12:59:51 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {A4A1F96B-A9C9-4F57-AB24-DEA5AFCAA06C}; ClientMachine = HV-CINDER-85920; User = ; ClientProcessId = 620; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{B587E2B1-4D59-4e7e-AED9-22B9DF11D053}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904593Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6202332hv-cinder-85920S-1-5-189/26/2022 12:59:51 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {A4A1F96B-A9C9-4F57-AB24-DEA5AFCAA06C}; ClientMachine = HV-CINDER-85920; User = ; ClientProcessId = 620; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{B087BE9D-ED37-454f-AF9C-04291E351182}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904592Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6202332hv-cinder-85920S-1-5-189/26/2022 12:59:51 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {A4A1F96B-A9C9-4F57-AB24-DEA5AFCAA06C}; ClientMachine = HV-CINDER-85920; User = ; ClientProcessId = 620; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{AADCED64-746C-4633-A97C-D61349046527}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904591Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6202332hv-cinder-85920S-1-5-189/26/2022 12:59:51 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {A4A1F96B-A9C9-4F57-AB24-DEA5AFCAA06C}; ClientMachine = HV-CINDER-85920; User = ; ClientProcessId = 620; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{A3F3E39B-5D83-4940-B954-28315B82F0A8}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904590Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6202332hv-cinder-85920S-1-5-189/26/2022 12:59:51 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {A4A1F96B-A9C9-4F57-AB24-DEA5AFCAA06C}; ClientMachine = HV-CINDER-85920; User = ; ClientProcessId = 620; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{91FBB303-0CD5-4055-BF42-E512A681B325}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904589Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6202332hv-cinder-85920S-1-5-189/26/2022 12:59:51 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {A4A1F96B-A9C9-4F57-AB24-DEA5AFCAA06C}; ClientMachine = HV-CINDER-85920; User = ; ClientProcessId = 620; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{8A28E2C5-8D06-49A4-A08C-632DAA493E17}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904588Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6202332hv-cinder-85920S-1-5-189/26/2022 12:59:51 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {A4A1F96B-A9C9-4F57-AB24-DEA5AFCAA06C}; ClientMachine = HV-CINDER-85920; User = ; ClientProcessId = 620; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{827D319E-6EAC-11D2-A4EA-00C04F79F83A}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904587Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6202332hv-cinder-85920S-1-5-189/26/2022 12:59:51 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {A4A1F96B-A9C9-4F57-AB24-DEA5AFCAA06C}; ClientMachine = HV-CINDER-85920; User = ; ClientProcessId = 620; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{7B849a69-220F-451E-B3FE-2CB811AF94AE}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904586Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6202332hv-cinder-85920S-1-5-189/26/2022 12:59:51 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {A4A1F96B-A9C9-4F57-AB24-DEA5AFCAA06C}; ClientMachine = HV-CINDER-85920; User = ; ClientProcessId = 620; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{7933F41E-56F8-41d6-A31C-4148A711EE93}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904585Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6202332hv-cinder-85920S-1-5-189/26/2022 12:59:51 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {A4A1F96B-A9C9-4F57-AB24-DEA5AFCAA06C}; ClientMachine = HV-CINDER-85920; User = ; ClientProcessId = 620; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{74EE6C03-5363-4554-B161-627540339CAB}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904584Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6202332hv-cinder-85920S-1-5-189/26/2022 12:59:51 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {A4A1F96B-A9C9-4F57-AB24-DEA5AFCAA06C}; ClientMachine = HV-CINDER-85920; User = ; ClientProcessId = 620; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{728EE579-943C-4519-9EF7-AB56765798ED}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904583Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6202332hv-cinder-85920S-1-5-189/26/2022 12:59:51 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {A4A1F96B-A9C9-4F57-AB24-DEA5AFCAA06C}; ClientMachine = HV-CINDER-85920; User = ; ClientProcessId = 620; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{7150F9BF-48AD-4da4-A49C-29EF4A8369BA}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904582Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6202332hv-cinder-85920S-1-5-189/26/2022 12:59:51 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {A4A1F96B-A9C9-4F57-AB24-DEA5AFCAA06C}; ClientMachine = HV-CINDER-85920; User = ; ClientProcessId = 620; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{6A4C88C6-C502-4f74-8F60-2CB23EDC24E2}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904581Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6202332hv-cinder-85920S-1-5-189/26/2022 12:59:51 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {A4A1F96B-A9C9-4F57-AB24-DEA5AFCAA06C}; ClientMachine = HV-CINDER-85920; User = ; ClientProcessId = 620; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{6232C319-91AC-4931-9385-E70C2B099F0E}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904580Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6202332hv-cinder-85920S-1-5-189/26/2022 12:59:51 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {A4A1F96B-A9C9-4F57-AB24-DEA5AFCAA06C}; ClientMachine = HV-CINDER-85920; User = ; ClientProcessId = 620; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{4CFB60C1-FAA6-47f1-89AA-0B18730C9FD3}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904579Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6202332hv-cinder-85920S-1-5-189/26/2022 12:59:51 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {A4A1F96B-A9C9-4F57-AB24-DEA5AFCAA06C}; ClientMachine = HV-CINDER-85920; User = ; ClientProcessId = 620; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{4bcd6cde-777b-48b6-9804-43568e23545d}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904578Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6202332hv-cinder-85920S-1-5-189/26/2022 12:59:51 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {A4A1F96B-A9C9-4F57-AB24-DEA5AFCAA06C}; ClientMachine = HV-CINDER-85920; User = ; ClientProcessId = 620; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{4B7C3B0F-E993-4E06-A241-3FBE06943684}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904577Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6202332hv-cinder-85920S-1-5-189/26/2022 12:59:51 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {A4A1F96B-A9C9-4F57-AB24-DEA5AFCAA06C}; ClientMachine = HV-CINDER-85920; User = ; ClientProcessId = 620; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{42B5FAAE-6536-11d2-AE5A-0000F87571E3}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904576Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6202332hv-cinder-85920S-1-5-189/26/2022 12:59:51 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {A4A1F96B-A9C9-4F57-AB24-DEA5AFCAA06C}; ClientMachine = HV-CINDER-85920; User = ; ClientProcessId = 620; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{426031c0-0b47-4852-b0ca-ac3d37bfcb39}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904575Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6202332hv-cinder-85920S-1-5-189/26/2022 12:59:51 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {A4A1F96B-A9C9-4F57-AB24-DEA5AFCAA06C}; ClientMachine = HV-CINDER-85920; User = ; ClientProcessId = 620; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{3A0DBA37-F8B2-4356-83DE-3E90BD5C261F}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904574Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6202332hv-cinder-85920S-1-5-189/26/2022 12:59:51 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {A4A1F96B-A9C9-4F57-AB24-DEA5AFCAA06C}; ClientMachine = HV-CINDER-85920; User = ; ClientProcessId = 620; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{3610eda5-77ef-11d2-8dc5-00c04fa31a66}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904573Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6202332hv-cinder-85920S-1-5-189/26/2022 12:59:51 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {A4A1F96B-A9C9-4F57-AB24-DEA5AFCAA06C}; ClientMachine = HV-CINDER-85920; User = ; ClientProcessId = 620; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{2BFCC077-22D2-48DE-BDE1-2F618D9B476D}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904572Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6202332hv-cinder-85920S-1-5-189/26/2022 12:59:51 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {A4A1F96B-A9C9-4F57-AB24-DEA5AFCAA06C}; ClientMachine = HV-CINDER-85920; User = ; ClientProcessId = 620; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{2A8FDC61-2347-4C87-92F6-B05EB91A201A}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904571Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6202332hv-cinder-85920S-1-5-189/26/2022 12:59:51 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {A4A1F96B-A9C9-4F57-AB24-DEA5AFCAA06C}; ClientMachine = HV-CINDER-85920; User = ; ClientProcessId = 620; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{1A6364EB-776B-4120-ADE1-B63A406A76B5}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904570Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6202332hv-cinder-85920S-1-5-189/26/2022 12:59:51 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {A4A1F96B-A9C9-4F57-AB24-DEA5AFCAA06C}; ClientMachine = HV-CINDER-85920; User = ; ClientProcessId = 620; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{17D89FEC-5C44-4972-B12D-241CAEF74509}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904569Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6202332hv-cinder-85920S-1-5-189/26/2022 12:59:51 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {A4A1F96B-A9C9-4F57-AB24-DEA5AFCAA06C}; ClientMachine = HV-CINDER-85920; User = ; ClientProcessId = 620; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{16be69fa-4209-4250-88cb-716cf41954e0}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904568Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6202332hv-cinder-85920S-1-5-189/26/2022 12:59:51 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {A4A1F96B-A9C9-4F57-AB24-DEA5AFCAA06C}; ClientMachine = HV-CINDER-85920; User = ; ClientProcessId = 620; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{169EBF44-942F-4C43-87CE-13C93996EBBE}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904567Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6202332hv-cinder-85920S-1-5-189/26/2022 12:59:51 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {A4A1F96B-A9C9-4F57-AB24-DEA5AFCAA06C}; ClientMachine = HV-CINDER-85920; User = ; ClientProcessId = 620; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{0E28E245-9368-4853-AD84-6DA3BA35BB75}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904566Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6202332hv-cinder-85920S-1-5-189/26/2022 12:59:51 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {A4A1F96B-A9C9-4F57-AB24-DEA5AFCAA06C}; ClientMachine = HV-CINDER-85920; User = ; ClientProcessId = 620; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{0ACDD40C-75AC-47ab-BAA0-BF6DE7E7FE63}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904565Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6202332hv-cinder-85920S-1-5-189/26/2022 12:59:51 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Namespace = //./root/CIMV2; NotificationQuery = select * from MSFT_SCMEventLogEvent; OwnerName = S-1-5-32-544; HostProcessID = 620; Provider= SCM Event Provider, queryID = 0; PossibleCause = Permanent585900004611686018427387904564Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6202992hv-cinder-85920S-1-5-189/26/2022 12:59:48 AM3435374a-d143-0001-b237-353443d1d801microsoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Namespace = root\virtualization\v2; NotificationQuery = SELECT * FROM __ClassOperationEvent; UserName = .\SYSTEM; ClientProcessID = 0, ClientMachine = ; PossibleCause = Temporary586000004611686018427387904563Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6202332hv-cinder-85920S-1-5-189/26/2022 12:59:48 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Namespace = //./root/subscription; Eventfilter = SCM Event Log Filter (refer to its activate eventid:5859); Consumer = NTEventLogEventConsumer="SCM Event Log Consumer"; PossibleCause = Binding EventFilter: instance of __EventFilter { CreatorSID = {1, 2, 0, 0, 0, 0, 0, 5, 32, 0, 0, 0, 32, 2, 0, 0}; EventNamespace = "root\\cimv2"; Name = "SCM Event Log Filter"; Query = "select * from MSFT_SCMEventLogEvent"; QueryLanguage = "WQL"; }; Perm. Consumer: instance of NTEventLogEventConsumer { Category = 0; CreatorSID = {1, 2, 0, 0, 0, 0, 0, 5, 32, 0, 0, 0, 32, 2, 0, 0}; EventType = 1; Name = "SCM Event Log Consumer"; NameOfUserSIDProperty = "sid"; SourceName = "Service Control Manager"; }; 586100004611686018427387904562Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6201352hv-cinder-85920S-1-5-189/26/2022 12:59:48 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32a provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2400; ProviderPath = %systemroot%\system32\wbem\wmipcima.dll585700004611686018427387904561Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational24002540hv-cinder-85920S-1-5-209/26/2022 12:59:48 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WMIProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3620; ProviderPath = %systemroot%\system32\wbem\wmiprov.dll585700004611686018427387904560Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational36203648hv-cinder-85920S-1-5-189/26/2022 12:59:46 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WMIProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3620; ProviderPath = %systemroot%\system32\wbem\wmiprov.dll585700004611686018427387904559Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational36203648hv-cinder-85920S-1-5-189/26/2022 12:59:46 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = HV-CINDER-85920; User = NT AUTHORITY\SYSTEM; ClientProcessId = 2956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User : __Namespace.name="S_1_5_21_2248989277_297465920_547592117_500"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904558Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6202332hv-cinder-85920S-1-5-189/26/2022 12:59:43 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = HV-CINDER-85920; User = NT AUTHORITY\SYSTEM; ClientProcessId = 2464; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\virtualization\v2 : Msvm_ResourcePoolComponent.Name="Microsoft|RDV Integration Component Resource Pool|V2.0"; ResultCode = 0x80041010; PossibleCause = Unknown585802004611686018427387904557Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6202808hv-cinder-85920S-1-5-189/26/2022 12:59:42 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2400; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll585700004611686018427387904556Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational24002536hv-cinder-85920S-1-5-209/26/2022 12:59:41 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-VS8AU7AUKE7; User = NT AUTHORITY\SYSTEM; ClientProcessId = 2636; Component = Unknown; Operation = Start IWbemServices::CreateInstanceEnum - root\wmi : MSiSCSI_PortalInfoClass; ResultCode = 0x8004100A; PossibleCause = Unknown585802004611686018427387904555Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5281836WIN-5T344G8GM1HS-1-5-189/26/2022 12:59:07 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-VS8AU7AUKE7; User = NT AUTHORITY\SYSTEM; ClientProcessId = 2636; Component = Unknown; Operation = Start IWbemServices::CreateInstanceEnum - root\wmi : MS_SM_AdapterInformationQuery; ResultCode = 0x8004100A; PossibleCause = Unknown585802004611686018427387904554Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5281836WIN-5T344G8GM1HS-1-5-189/26/2022 12:59:07 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-VS8AU7AUKE7; User = NT AUTHORITY\SYSTEM; ClientProcessId = 2260; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\virtualization\v2 : Msvm_ResourcePoolComponent.Name="Microsoft|RDV Integration Component Resource Pool|V2.0"; ResultCode = 0x80041010; PossibleCause = Unknown585802004611686018427387904553Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5282544WIN-5T344G8GM1HS-1-5-189/26/2022 12:58:13 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-VS8AU7AUKE7; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1708; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\cimv2 : select * from Win32_OperatingSystem; ResultCode = 0x8004100A; PossibleCause = Unknown585802004611686018427387904552Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5282540WIN-5T344G8GM1HS-1-5-189/26/2022 12:58:13 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4848; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\wmi : select * from WDMClassesOfDriver where ClassName = "RNDISMPStatisticsOID"; ResultCode = 0x80041032; PossibleCause = Unknown585802004611686018427387904551Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9763432WIN-5T344G8GM1HS-1-5-181/19/2018 9:48:09 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4848; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\wmi : select * from WMIBinaryMofResource where Name = "C:\\windows\\System32\\drivers\\en-US\\netvsc.sys.mui[NdisMofResource]"; ResultCode = 0x80041032; PossibleCause = Unknown585802004611686018427387904550Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9763432WIN-5T344G8GM1HS-1-5-181/19/2018 9:48:09 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
MSVDS__PROVIDER provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4460; ProviderPath = %systemroot%\system32\wbem\vdswmi.dll585700004611686018427387904549Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational44605048WIN-5T344G8GM1HS-1-5-201/19/2018 9:46:31 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4460; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll585700004611686018427387904548Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational44605048WIN-5T344G8GM1HS-1-5-201/19/2018 9:46:31 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WMIProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4848; ProviderPath = %systemroot%\system32\wbem\wmiprov.dll585700004611686018427387904547Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational48484776WIN-5T344G8GM1HS-1-5-181/19/2018 9:45:30 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = WIN-5T344G8GM1H\Administrator; ClientProcessId = 4956; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\Microsoft\Windows\Defender : SELECT * FROM MSFT_MpComputerStatus; ResultCode = 0x80041032; PossibleCause = Unknown585802004611686018427387904546Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9761176WIN-5T344G8GM1HS-1-5-181/19/2018 9:42:52 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
ProtectionManagement provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3752; ProviderPath = "%ProgramData%\Microsoft\Windows Defender\Platform\4.12.17007.18011-0\ProtectionManagement.dll"585700004611686018427387904545Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational37522228WIN-5T344G8GM1HS-1-5-191/19/2018 9:42:52 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
MsNetImPlatform provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2776; ProviderPath = %systemroot%\system32\wbem\ndisimplatcim.dll585700004611686018427387904544Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational27763064WIN-5T344G8GM1HS-1-5-201/19/2018 9:42:52 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4120; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll585700004611686018427387904543Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational41204148WIN-5T344G8GM1HS-1-5-181/19/2018 9:42:50 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
nettcpip provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2776; ProviderPath = %systemroot%\system32\wbem\NetTCPIP.dll585700004611686018427387904542Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational27761292WIN-5T344G8GM1HS-1-5-201/19/2018 9:42:48 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NetAdapterCim provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3752; ProviderPath = %systemroot%\system32\wbem\NetAdapterCim.dll585700004611686018427387904541Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational37522228WIN-5T344G8GM1HS-1-5-191/19/2018 9:42:48 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2776; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll585700004611686018427387904540Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational27763064WIN-5T344G8GM1HS-1-5-201/19/2018 9:42:48 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
MSVDS__PROVIDER provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2776; ProviderPath = %systemroot%\system32\wbem\vdswmi.dll585700004611686018427387904539Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational27763064WIN-5T344G8GM1HS-1-5-201/19/2018 9:42:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32a provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2776; ProviderPath = %systemroot%\system32\wbem\wmipcima.dll585700004611686018427387904538Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational27763064WIN-5T344G8GM1HS-1-5-201/19/2018 9:42:16 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4120; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll585700004611686018427387904537Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational41204148WIN-5T344G8GM1HS-1-5-181/19/2018 9:41:43 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
nettcpip provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2776; ProviderPath = %systemroot%\system32\wbem\NetTCPIP.dll585700004611686018427387904536Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational27761292WIN-5T344G8GM1HS-1-5-201/19/2018 9:41:39 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NetAdapterCim provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3752; ProviderPath = %systemroot%\system32\wbem\NetAdapterCim.dll585700004611686018427387904535Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational37522228WIN-5T344G8GM1HS-1-5-191/19/2018 9:41:39 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2776; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll585700004611686018427387904534Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational27762812WIN-5T344G8GM1HS-1-5-201/19/2018 9:41:39 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Namespace = //./root/CIMV2; NotificationQuery = select * from MSFT_SCMEventLogEvent; OwnerName = S-1-5-32-544; HostProcessID = 976; Provider= SCM Event Provider, queryID = 0; PossibleCause = Permanent585900004611686018427387904533Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9762172WIN-5T344G8GM1HS-1-5-181/19/2018 9:41:32 AMad8d0f9c-9109-0001-0a10-8dad0991d301microsoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Namespace = root\virtualization\v2; NotificationQuery = SELECT * FROM __ClassOperationEvent; UserName = .\SYSTEM; ClientProcessID = 0, ClientMachine = ; PossibleCause = Temporary586000004611686018427387904532Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9762680WIN-5T344G8GM1HS-1-5-181/19/2018 9:41:32 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Namespace = //./root/subscription; Eventfilter = SCM Event Log Filter (refer to its activate eventid:5859); Consumer = NTEventLogEventConsumer="SCM Event Log Consumer"; PossibleCause = Binding EventFilter: instance of __EventFilter { CreatorSID = {1, 2, 0, 0, 0, 0, 0, 5, 32, 0, 0, 0, 32, 2, 0, 0}; EventNamespace = "root\\cimv2"; Name = "SCM Event Log Filter"; Query = "select * from MSFT_SCMEventLogEvent"; QueryLanguage = "WQL"; }; Perm. Consumer: instance of NTEventLogEventConsumer { Category = 0; CreatorSID = {1, 2, 0, 0, 0, 0, 0, 5, 32, 0, 0, 0, 32, 2, 0, 0}; EventType = 1; Name = "SCM Event Log Consumer"; NameOfUserSIDProperty = "sid"; SourceName = "Service Control Manager"; }; 586100004611686018427387904531Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational976388WIN-5T344G8GM1HS-1-5-181/19/2018 9:41:32 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{FC491EF1-C4AA-4CE1-B329-414B101DB823}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904530Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9762680WIN-5T344G8GM1HS-1-5-181/19/2018 9:41:32 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{fbf687e6-f063-4d9f-9f4f-fd9a26acdd5f}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904529Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9762680WIN-5T344G8GM1HS-1-5-181/19/2018 9:41:32 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{FB2CA36D-0B40-4307-821B-A13B252DE56C}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904528Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9762680WIN-5T344G8GM1HS-1-5-181/19/2018 9:41:32 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{f3ccc681-b74c-4060-9f26-cd84525dca2a}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904527Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9762680WIN-5T344G8GM1HS-1-5-181/19/2018 9:41:32 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{F312195E-3D9D-447A-A3F5-08DFFA24735E}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904526Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9762680WIN-5T344G8GM1HS-1-5-181/19/2018 9:41:32 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{E62688F0-25FD-4c90-BFF5-F508B9D2E31F}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904525Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9762680WIN-5T344G8GM1HS-1-5-181/19/2018 9:41:32 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{E5094040-C46C-4115-B030-04FB2E545B00}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904524Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9762680WIN-5T344G8GM1HS-1-5-181/19/2018 9:41:32 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{E4F48E54-F38D-4884-BFB9-D4D2E5729C18}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904523Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9762680WIN-5T344G8GM1HS-1-5-181/19/2018 9:41:32 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{e437bc1c-aa7d-11d2-a382-00c04f991e27}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904522Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9762680WIN-5T344G8GM1HS-1-5-181/19/2018 9:41:32 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{CF7639F3-ABA2-41DB-97F2-81E2C5DBFC5D}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904521Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9762680WIN-5T344G8GM1HS-1-5-181/19/2018 9:41:32 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{cdeafc3d-948d-49dd-ab12-e578ba4af7aa}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904520Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9762680WIN-5T344G8GM1HS-1-5-181/19/2018 9:41:32 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{c6dc5466-785a-11d2-84d0-00c04fb169f7}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904519Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9762680WIN-5T344G8GM1HS-1-5-181/19/2018 9:41:32 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{C631DF4C-088F-4156-B058-4375F0853CD8}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904518Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9762680WIN-5T344G8GM1HS-1-5-181/19/2018 9:41:32 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{C418DD9D-0D14-4efb-8FBF-CFE535C8FAC7}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904517Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9762680WIN-5T344G8GM1HS-1-5-181/19/2018 9:41:32 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{C34B2751-1CF4-44F5-9262-C3FC39666591}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904516Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9762680WIN-5T344G8GM1HS-1-5-181/19/2018 9:41:32 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{BC75B1ED-5833-4858-9BB8-CBF0B166DF9D}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904515Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9762680WIN-5T344G8GM1HS-1-5-181/19/2018 9:41:32 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{BA649533-0AAC-4E04-B9BC-4DBAE0325B12}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904514Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9762680WIN-5T344G8GM1HS-1-5-181/19/2018 9:41:32 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{B587E2B1-4D59-4e7e-AED9-22B9DF11D053}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904513Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9762680WIN-5T344G8GM1HS-1-5-181/19/2018 9:41:32 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{B087BE9D-ED37-454f-AF9C-04291E351182}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904512Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9762680WIN-5T344G8GM1HS-1-5-181/19/2018 9:41:32 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{AADCED64-746C-4633-A97C-D61349046527}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904511Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9762680WIN-5T344G8GM1HS-1-5-181/19/2018 9:41:32 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{A3F3E39B-5D83-4940-B954-28315B82F0A8}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904510Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9762680WIN-5T344G8GM1HS-1-5-181/19/2018 9:41:32 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{91FBB303-0CD5-4055-BF42-E512A681B325}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904509Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9762680WIN-5T344G8GM1HS-1-5-181/19/2018 9:41:32 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{8A28E2C5-8D06-49A4-A08C-632DAA493E17}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904508Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9762680WIN-5T344G8GM1HS-1-5-181/19/2018 9:41:32 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{827D319E-6EAC-11D2-A4EA-00C04F79F83A}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904507Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9762680WIN-5T344G8GM1HS-1-5-181/19/2018 9:41:32 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{7B849a69-220F-451E-B3FE-2CB811AF94AE}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904506Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9762680WIN-5T344G8GM1HS-1-5-181/19/2018 9:41:32 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{7933F41E-56F8-41d6-A31C-4148A711EE93}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904505Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9762680WIN-5T344G8GM1HS-1-5-181/19/2018 9:41:32 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{74EE6C03-5363-4554-B161-627540339CAB}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904504Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9762680WIN-5T344G8GM1HS-1-5-181/19/2018 9:41:32 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{728EE579-943C-4519-9EF7-AB56765798ED}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904503Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9762680WIN-5T344G8GM1HS-1-5-181/19/2018 9:41:32 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{7150F9BF-48AD-4da4-A49C-29EF4A8369BA}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904502Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9762680WIN-5T344G8GM1HS-1-5-181/19/2018 9:41:32 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{6A4C88C6-C502-4f74-8F60-2CB23EDC24E2}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904501Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9762680WIN-5T344G8GM1HS-1-5-181/19/2018 9:41:32 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{6232C319-91AC-4931-9385-E70C2B099F0E}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904500Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9762680WIN-5T344G8GM1HS-1-5-181/19/2018 9:41:32 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{4CFB60C1-FAA6-47f1-89AA-0B18730C9FD3}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904499Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9762680WIN-5T344G8GM1HS-1-5-181/19/2018 9:41:32 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{4bcd6cde-777b-48b6-9804-43568e23545d}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904498Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9762680WIN-5T344G8GM1HS-1-5-181/19/2018 9:41:32 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{4B7C3B0F-E993-4E06-A241-3FBE06943684}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904497Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9762680WIN-5T344G8GM1HS-1-5-181/19/2018 9:41:32 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{42B5FAAE-6536-11d2-AE5A-0000F87571E3}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904496Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9762680WIN-5T344G8GM1HS-1-5-181/19/2018 9:41:32 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{426031c0-0b47-4852-b0ca-ac3d37bfcb39}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904495Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9762680WIN-5T344G8GM1HS-1-5-181/19/2018 9:41:32 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{3A0DBA37-F8B2-4356-83DE-3E90BD5C261F}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904494Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9762680WIN-5T344G8GM1HS-1-5-181/19/2018 9:41:32 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{3610eda5-77ef-11d2-8dc5-00c04fa31a66}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904493Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9762680WIN-5T344G8GM1HS-1-5-181/19/2018 9:41:32 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{2BFCC077-22D2-48DE-BDE1-2F618D9B476D}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904492Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9762680WIN-5T344G8GM1HS-1-5-181/19/2018 9:41:32 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{2A8FDC61-2347-4C87-92F6-B05EB91A201A}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904491Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9762680WIN-5T344G8GM1HS-1-5-181/19/2018 9:41:32 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{1A6364EB-776B-4120-ADE1-B63A406A76B5}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904490Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9762680WIN-5T344G8GM1HS-1-5-181/19/2018 9:41:32 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{17D89FEC-5C44-4972-B12D-241CAEF74509}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904489Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9762680WIN-5T344G8GM1HS-1-5-181/19/2018 9:41:32 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{16be69fa-4209-4250-88cb-716cf41954e0}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904488Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9762680WIN-5T344G8GM1HS-1-5-181/19/2018 9:41:32 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{169EBF44-942F-4C43-87CE-13C93996EBBE}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904487Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9762680WIN-5T344G8GM1HS-1-5-181/19/2018 9:41:32 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{0E28E245-9368-4853-AD84-6DA3BA35BB75}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904486Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9762680WIN-5T344G8GM1HS-1-5-181/19/2018 9:41:32 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{0ACDD40C-75AC-47ab-BAA0-BF6DE7E7FE63}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904485Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9762680WIN-5T344G8GM1HS-1-5-181/19/2018 9:41:32 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2776; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll585700004611686018427387904484Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational27762848WIN-5T344G8GM1HS-1-5-201/19/2018 9:41:31 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 2204; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\virtualization\v2 : Msvm_ResourcePoolComponent.Name="Microsoft|RDV Integration Component Resource Pool|V2.0"; ResultCode = 0x80041010; PossibleCause = Unknown585802004611686018427387904483Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9762692WIN-5T344G8GM1HS-1-5-181/19/2018 9:41:30 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3176; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll585700004611686018427387904482Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational31761548WIN-5T344G8GM1HS-1-5-201/19/2018 9:40:26 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3952; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\interop\ms_409 : MSFTSM_RegisteredSubprofile; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904481Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9564728WIN-5T344G8GM1HS-1-5-181/19/2018 9:38:50 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3952; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\interop\ms_409 : MSFTSM_SubProfileRequiresProfile; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904480Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9564728WIN-5T344G8GM1HS-1-5-181/19/2018 9:38:50 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3952; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\interop\ms_409 : MSFTSM_RegisteredProfile; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904479Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9564728WIN-5T344G8GM1HS-1-5-181/19/2018 9:38:50 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3952; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\interop\ms_409 : MSFTSM_ReferencedProfile; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904478Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9564728WIN-5T344G8GM1HS-1-5-181/19/2018 9:38:50 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3952; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\interop\ms_409 : MSFTSM_ElementSoftwareIdentity; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904477Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9564728WIN-5T344G8GM1HS-1-5-181/19/2018 9:38:50 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3952; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\interop\ms_409 : MSFTSM_ElementConformsToProfileEx; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904476Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9564728WIN-5T344G8GM1HS-1-5-181/19/2018 9:38:50 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3952; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\interop\ms_409 : MSFTSM_ElementConformsToProfile; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904475Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9564728WIN-5T344G8GM1HS-1-5-181/19/2018 9:38:50 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3952; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\cimv2\storage\ms_409 : __Namespace.Name='iscsitarget'; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904474Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9564728WIN-5T344G8GM1HS-1-5-181/19/2018 9:38:50 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WMIProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3968; ProviderPath = %systemroot%\system32\wbem\wmiprov.dll585700004611686018427387904473Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational39684084WIN-5T344G8GM1HS-1-5-181/19/2018 9:38:50 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
MSVDS__PROVIDER provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2712; ProviderPath = %systemroot%\system32\wbem\vdswmi.dll585700004611686018427387904472Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational2712592WIN-5T344G8GM1HS-1-5-201/19/2018 9:38:50 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2712; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll585700004611686018427387904471Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational2712592WIN-5T344G8GM1HS-1-5-201/19/2018 9:38:49 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
nettcpip provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4348; ProviderPath = %systemroot%\system32\wbem\NetTCPIP.dll585700004611686018427387904470Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational43482924WIN-5T344G8GM1HS-1-5-201/19/2018 9:35:55 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NetAdapterCim provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4444; ProviderPath = %systemroot%\system32\wbem\NetAdapterCim.dll585700004611686018427387904469Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational44444516WIN-5T344G8GM1HS-1-5-191/19/2018 9:35:55 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4348; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll585700004611686018427387904468Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational43484632WIN-5T344G8GM1HS-1-5-201/19/2018 9:35:55 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
MSVDS__PROVIDER provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4348; ProviderPath = %systemroot%\system32\wbem\vdswmi.dll585700004611686018427387904467Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational43484632WIN-5T344G8GM1HS-1-5-201/19/2018 9:35:41 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4348; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll585700004611686018427387904466Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational43484632WIN-5T344G8GM1HS-1-5-201/19/2018 9:35:41 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
nettcpip provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4824; ProviderPath = %systemroot%\system32\wbem\NetTCPIP.dll585700004611686018427387904465Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational48241600WIN-5T344G8GM1HS-1-5-201/19/2018 9:34:04 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NetAdapterCim provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1548; ProviderPath = %systemroot%\system32\wbem\NetAdapterCim.dll585700004611686018427387904464Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational15482160WIN-5T344G8GM1HS-1-5-191/19/2018 9:34:04 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4824; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll585700004611686018427387904463Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational48241600WIN-5T344G8GM1HS-1-5-201/19/2018 9:34:04 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4824; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll585700004611686018427387904462Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational48244808WIN-5T344G8GM1HS-1-5-201/19/2018 9:34:04 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 764; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll585700004611686018427387904461Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational7641020WIN-5T344G8GM1HS-1-5-181/19/2018 9:33:46 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
MSVDS__PROVIDER provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4824; ProviderPath = %systemroot%\system32\wbem\vdswmi.dll585700004611686018427387904460Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational48244808WIN-5T344G8GM1HS-1-5-201/19/2018 9:32:20 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4824; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll585700004611686018427387904459Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational48244808WIN-5T344G8GM1HS-1-5-201/19/2018 9:32:20 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WMIProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3968; ProviderPath = %systemroot%\system32\wbem\wmiprov.dll585700004611686018427387904458Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational39684084WIN-5T344G8GM1HS-1-5-181/19/2018 9:31:16 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
MSVDS__PROVIDER provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1520; ProviderPath = %systemroot%\system32\wbem\vdswmi.dll585700004611686018427387904457Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational15202704WIN-5T344G8GM1HS-1-5-201/19/2018 9:29:44 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1520; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll585700004611686018427387904456Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational15202704WIN-5T344G8GM1HS-1-5-201/19/2018 9:29:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {4693033F-66F0-46C4-8E27-99621765768B}; ClientMachine = WIN-5T344G8GM1H; User = WIN-5T344G8GM1H\Administrator; ClientProcessId = 4124; Component = Core; Operation = Start IWbemServices::ExecMethod - root\microsoft\windows\servermanager : MSFT_ServerManagerTasks::GetServerFeature; ResultCode = 0x800706BE; PossibleCause = Could not send status to client585802004611686018427387904455Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562716WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:32 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {4693033F-66F0-46C4-8E27-99621765768B}; ClientMachine = WIN-5T344G8GM1H; User = WIN-5T344G8GM1H\Administrator; ClientProcessId = 4124; Component = Unknown; Operation = Start IWbemServices::ExecMethod - root\microsoft\windows\servermanager : MSFT_ServerManagerTasks::GetServerFeature; ResultCode = 0x80041032; PossibleCause = Unknown585802004611686018427387904454Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational956432WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:32 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4608; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll585700004611686018427387904453Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational46084636WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:30 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
nettcpip provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2872; ProviderPath = %systemroot%\system32\wbem\NetTCPIP.dll585700004611686018427387904452Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational28722896WIN-5T344G8GM1HS-1-5-201/19/2018 9:27:26 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NetAdapterCim provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4344; ProviderPath = %systemroot%\system32\wbem\NetAdapterCim.dll585700004611686018427387904451Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational43444368WIN-5T344G8GM1HS-1-5-191/19/2018 9:27:26 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2872; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll585700004611686018427387904450Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational28722900WIN-5T344G8GM1HS-1-5-201/19/2018 9:27:25 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
MSVDS__PROVIDER provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2872; ProviderPath = %systemroot%\system32\wbem\vdswmi.dll585700004611686018427387904449Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational28722900WIN-5T344G8GM1HS-1-5-201/19/2018 9:27:20 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32a provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2872; ProviderPath = %systemroot%\system32\wbem\wmipcima.dll585700004611686018427387904448Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational28722900WIN-5T344G8GM1HS-1-5-201/19/2018 9:27:19 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Namespace = //./root/CIMV2; NotificationQuery = select * from MSFT_SCMEventLogEvent; OwnerName = S-1-5-32-544; HostProcessID = 956; Provider= SCM Event Provider, queryID = 0; PossibleCause = Permanent585900004611686018427387904447Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562284WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:18 AMaff0bd57-9107-0002-9bbd-f0af0791d301microsoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Namespace = root\virtualization\v2; NotificationQuery = SELECT * FROM __ClassOperationEvent; UserName = .\SYSTEM; ClientProcessID = 0, ClientMachine = ; PossibleCause = Temporary586000004611686018427387904446Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:18 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Namespace = //./root/subscription; Eventfilter = SCM Event Log Filter (refer to its activate eventid:5859); Consumer = NTEventLogEventConsumer="SCM Event Log Consumer"; PossibleCause = Binding EventFilter: instance of __EventFilter { CreatorSID = {1, 2, 0, 0, 0, 0, 0, 5, 32, 0, 0, 0, 32, 2, 0, 0}; EventNamespace = "root\\cimv2"; Name = "SCM Event Log Filter"; Query = "select * from MSFT_SCMEventLogEvent"; QueryLanguage = "WQL"; }; Perm. Consumer: instance of NTEventLogEventConsumer { Category = 0; CreatorSID = {1, 2, 0, 0, 0, 0, 0, 5, 32, 0, 0, 0, 32, 2, 0, 0}; EventType = 1; Name = "SCM Event Log Consumer"; NameOfUserSIDProperty = "sid"; SourceName = "Service Control Manager"; }; 586100004611686018427387904445Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562284WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:18 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{FC491EF1-C4AA-4CE1-B329-414B101DB823}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904444Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{fbf687e6-f063-4d9f-9f4f-fd9a26acdd5f}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904443Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{FB2CA36D-0B40-4307-821B-A13B252DE56C}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904442Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{f3ccc681-b74c-4060-9f26-cd84525dca2a}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904441Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{F312195E-3D9D-447A-A3F5-08DFFA24735E}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904440Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{E62688F0-25FD-4c90-BFF5-F508B9D2E31F}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904439Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{E5094040-C46C-4115-B030-04FB2E545B00}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904438Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{E4F48E54-F38D-4884-BFB9-D4D2E5729C18}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904437Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{e437bc1c-aa7d-11d2-a382-00c04f991e27}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904436Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{CF7639F3-ABA2-41DB-97F2-81E2C5DBFC5D}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904435Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{cdeafc3d-948d-49dd-ab12-e578ba4af7aa}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904434Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{c6dc5466-785a-11d2-84d0-00c04fb169f7}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904433Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{C631DF4C-088F-4156-B058-4375F0853CD8}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904432Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{C418DD9D-0D14-4efb-8FBF-CFE535C8FAC7}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904431Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{C34B2751-1CF4-44F5-9262-C3FC39666591}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904430Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{BC75B1ED-5833-4858-9BB8-CBF0B166DF9D}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904429Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{BA649533-0AAC-4E04-B9BC-4DBAE0325B12}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904428Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{B587E2B1-4D59-4e7e-AED9-22B9DF11D053}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904427Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{B087BE9D-ED37-454f-AF9C-04291E351182}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904426Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{AADCED64-746C-4633-A97C-D61349046527}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904425Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{A3F3E39B-5D83-4940-B954-28315B82F0A8}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904424Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{91FBB303-0CD5-4055-BF42-E512A681B325}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904423Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{8A28E2C5-8D06-49A4-A08C-632DAA493E17}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904422Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{827D319E-6EAC-11D2-A4EA-00C04F79F83A}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904421Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{7B849a69-220F-451E-B3FE-2CB811AF94AE}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904420Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562864WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{7933F41E-56F8-41d6-A31C-4148A711EE93}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904419Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562864WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{74EE6C03-5363-4554-B161-627540339CAB}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904418Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562864WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{728EE579-943C-4519-9EF7-AB56765798ED}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904417Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562864WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{7150F9BF-48AD-4da4-A49C-29EF4A8369BA}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904416Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562864WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{6A4C88C6-C502-4f74-8F60-2CB23EDC24E2}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904415Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562864WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{6232C319-91AC-4931-9385-E70C2B099F0E}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904414Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562864WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{4CFB60C1-FAA6-47f1-89AA-0B18730C9FD3}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904413Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562868WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{4bcd6cde-777b-48b6-9804-43568e23545d}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904412Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{4B7C3B0F-E993-4E06-A241-3FBE06943684}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904411Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{42B5FAAE-6536-11d2-AE5A-0000F87571E3}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904410Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562864WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{426031c0-0b47-4852-b0ca-ac3d37bfcb39}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904409Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562864WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{3A0DBA37-F8B2-4356-83DE-3E90BD5C261F}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904408Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562864WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{3610eda5-77ef-11d2-8dc5-00c04fa31a66}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904407Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562864WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{2BFCC077-22D2-48DE-BDE1-2F618D9B476D}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904406Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562864WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{2A8FDC61-2347-4C87-92F6-B05EB91A201A}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904405Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562868WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{1A6364EB-776B-4120-ADE1-B63A406A76B5}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904404Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562864WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{17D89FEC-5C44-4972-B12D-241CAEF74509}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904403Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562864WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{16be69fa-4209-4250-88cb-716cf41954e0}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904402Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562864WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{169EBF44-942F-4C43-87CE-13C93996EBBE}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904401Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{0E28E245-9368-4853-AD84-6DA3BA35BB75}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904400Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{0ACDD40C-75AC-47ab-BAA0-BF6DE7E7FE63}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904399Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{FC491EF1-C4AA-4CE1-B329-414B101DB823}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904398Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{fbf687e6-f063-4d9f-9f4f-fd9a26acdd5f}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904397Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{FB2CA36D-0B40-4307-821B-A13B252DE56C}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904396Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{f3ccc681-b74c-4060-9f26-cd84525dca2a}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904395Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{F312195E-3D9D-447A-A3F5-08DFFA24735E}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904394Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{E62688F0-25FD-4c90-BFF5-F508B9D2E31F}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904393Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{E5094040-C46C-4115-B030-04FB2E545B00}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904392Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{E4F48E54-F38D-4884-BFB9-D4D2E5729C18}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904391Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{e437bc1c-aa7d-11d2-a382-00c04f991e27}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904390Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{CF7639F3-ABA2-41DB-97F2-81E2C5DBFC5D}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904389Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{cdeafc3d-948d-49dd-ab12-e578ba4af7aa}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904388Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{c6dc5466-785a-11d2-84d0-00c04fb169f7}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904387Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{C631DF4C-088F-4156-B058-4375F0853CD8}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904386Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{C418DD9D-0D14-4efb-8FBF-CFE535C8FAC7}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904385Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{C34B2751-1CF4-44F5-9262-C3FC39666591}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904384Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{BC75B1ED-5833-4858-9BB8-CBF0B166DF9D}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904383Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{BA649533-0AAC-4E04-B9BC-4DBAE0325B12}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904382Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{B587E2B1-4D59-4e7e-AED9-22B9DF11D053}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904381Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{B087BE9D-ED37-454f-AF9C-04291E351182}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904380Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{AADCED64-746C-4633-A97C-D61349046527}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904379Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{A3F3E39B-5D83-4940-B954-28315B82F0A8}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904378Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{91FBB303-0CD5-4055-BF42-E512A681B325}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904377Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{8A28E2C5-8D06-49A4-A08C-632DAA493E17}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904376Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{827D319E-6EAC-11D2-A4EA-00C04F79F83A}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904375Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{7B849a69-220F-451E-B3FE-2CB811AF94AE}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904374Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{7933F41E-56F8-41d6-A31C-4148A711EE93}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904373Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{74EE6C03-5363-4554-B161-627540339CAB}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904372Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{728EE579-943C-4519-9EF7-AB56765798ED}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904371Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{7150F9BF-48AD-4da4-A49C-29EF4A8369BA}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904370Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{6A4C88C6-C502-4f74-8F60-2CB23EDC24E2}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904369Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{6232C319-91AC-4931-9385-E70C2B099F0E}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904368Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{4CFB60C1-FAA6-47f1-89AA-0B18730C9FD3}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904367Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{4bcd6cde-777b-48b6-9804-43568e23545d}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904366Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{4B7C3B0F-E993-4E06-A241-3FBE06943684}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904365Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{42B5FAAE-6536-11d2-AE5A-0000F87571E3}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904364Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{426031c0-0b47-4852-b0ca-ac3d37bfcb39}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904363Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{3A0DBA37-F8B2-4356-83DE-3E90BD5C261F}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904362Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{3610eda5-77ef-11d2-8dc5-00c04fa31a66}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904361Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{2BFCC077-22D2-48DE-BDE1-2F618D9B476D}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904360Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{2A8FDC61-2347-4C87-92F6-B05EB91A201A}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904359Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{1A6364EB-776B-4120-ADE1-B63A406A76B5}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904358Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{17D89FEC-5C44-4972-B12D-241CAEF74509}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904357Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{16be69fa-4209-4250-88cb-716cf41954e0}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904356Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{169EBF44-942F-4C43-87CE-13C93996EBBE}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904355Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{0E28E245-9368-4853-AD84-6DA3BA35BB75}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904354Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{0ACDD40C-75AC-47ab-BAA0-BF6DE7E7FE63}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904353Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2872; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll585700004611686018427387904352Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational28722900WIN-5T344G8GM1HS-1-5-201/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 2336; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\virtualization\v2 : Msvm_ResourcePoolComponent.Name="Microsoft|RDV Integration Component Resource Pool|V2.0"; ResultCode = 0x80041010; PossibleCause = Unknown585802004611686018427387904351Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562864WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Namespace = ROOT\virtualization\v2; NotificationQuery = SELECT * FROM __ClassOperationEvent; UserName = .\SYSTEM; ClientProcessID = 0, ClientMachine = ; PossibleCause = Temporary586000004611686018427387904350Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9682820WIN-5T344G8GM1HS-1-5-181/19/2018 9:26:58 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 2360; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\virtualization\v2 : Msvm_ResourcePoolComponent.Name="Microsoft|RDV Integration Component Resource Pool|V2.0"; ResultCode = 0x80041010; PossibleCause = Unknown585802004611686018427387904349Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9682820WIN-5T344G8GM1HS-1-5-181/19/2018 9:26:52 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\HyperVCluster\v2 : Msvm_VirtualHardDiskState; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904348Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9682820WIN-5T344G8GM1HS-1-5-181/19/2018 9:26:51 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\HyperVCluster\v2 : Msvm_VirtualHardDiskSettingData; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904347Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9682820WIN-5T344G8GM1HS-1-5-181/19/2018 9:26:51 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\HyperVCluster\v2 : Msvm_VirtualHardDiskInfo; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904346Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9682820WIN-5T344G8GM1HS-1-5-181/19/2018 9:26:51 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\HyperVCluster\v2 : Msvm_ServicingSettings; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904345Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9682820WIN-5T344G8GM1HS-1-5-181/19/2018 9:26:51 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\HyperVCluster\v2 : CIM_SettingsDefineState; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904344Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9682820WIN-5T344G8GM1HS-1-5-181/19/2018 9:26:51 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\HyperVCluster\v2 : CIM_ServiceAffectsElement; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904343Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9682820WIN-5T344G8GM1HS-1-5-181/19/2018 9:26:51 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\HyperVCluster\v2 : CIM_ManagedElement; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904342Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9682820WIN-5T344G8GM1HS-1-5-181/19/2018 9:26:51 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\HyperVCluster\v2 : CIM_ElementSettingData; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904341Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9682820WIN-5T344G8GM1HS-1-5-181/19/2018 9:26:51 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\HyperVCluster\v2 : CIM_ElementCapabilities; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904340Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9682820WIN-5T344G8GM1HS-1-5-181/19/2018 9:26:51 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\HyperVCluster\v2 : CIM_Dependency; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904339Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9682820WIN-5T344G8GM1HS-1-5-181/19/2018 9:26:51 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\HyperVCluster\v2 : CIM_Component; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904338Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9682820WIN-5T344G8GM1HS-1-5-181/19/2018 9:26:51 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\HyperVCluster\v2 : CIM_AffectedJobElement; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904337Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9682820WIN-5T344G8GM1HS-1-5-181/19/2018 9:26:51 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\HyperVCluster\v2\ms_409 : Msvm_SummaryInformationBase; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904336Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9682820WIN-5T344G8GM1HS-1-5-181/19/2018 9:26:51 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\HyperVCluster\v2\ms_409 : CIM_SettingsDefineState; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904335Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9682820WIN-5T344G8GM1HS-1-5-181/19/2018 9:26:51 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\HyperVCluster\v2\ms_409 : CIM_ServiceAffectsElement; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904334Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9682824WIN-5T344G8GM1HS-1-5-181/19/2018 9:26:51 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\HyperVCluster\v2\ms_409 : CIM_ManagedElement; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904333Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9682820WIN-5T344G8GM1HS-1-5-181/19/2018 9:26:51 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\HyperVCluster\v2\ms_409 : CIM_ElementSettingData; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904332Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9682820WIN-5T344G8GM1HS-1-5-181/19/2018 9:26:51 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\HyperVCluster\v2\ms_409 : CIM_ElementCapabilities; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904331Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9682820WIN-5T344G8GM1HS-1-5-181/19/2018 9:26:51 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\HyperVCluster\v2\ms_409 : CIM_Dependency; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904330Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9682820WIN-5T344G8GM1HS-1-5-181/19/2018 9:26:51 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\HyperVCluster\v2\ms_409 : CIM_Component; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904329Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9682820WIN-5T344G8GM1HS-1-5-181/19/2018 9:26:51 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\HyperVCluster\v2\ms_409 : CIM_AffectedJobElement; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904328Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9682820WIN-5T344G8GM1HS-1-5-181/19/2018 9:26:51 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Namespace = //./root/CIMV2; NotificationQuery = select * from MSFT_SCMEventLogEvent; OwnerName = S-1-5-32-544; HostProcessID = 968; Provider= SCM Event Provider, queryID = 0; PossibleCause = Permanent585900004611686018427387904327Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9682948WIN-5T344G8GM1HS-1-5-181/19/2018 9:26:51 AM96ed06e7-9107-0000-3d07-ed960791d301microsoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Namespace = //./root/subscription; Eventfilter = SCM Event Log Filter (refer to its activate eventid:5859); Consumer = NTEventLogEventConsumer="SCM Event Log Consumer"; PossibleCause = Binding EventFilter: instance of __EventFilter { CreatorSID = {1, 2, 0, 0, 0, 0, 0, 5, 32, 0, 0, 0, 32, 2, 0, 0}; EventNamespace = "root\\cimv2"; Name = "SCM Event Log Filter"; Query = "select * from MSFT_SCMEventLogEvent"; QueryLanguage = "WQL"; }; Perm. Consumer: instance of NTEventLogEventConsumer { Category = 0; CreatorSID = {1, 2, 0, 0, 0, 0, 0, 5, 32, 0, 0, 0, 32, 2, 0, 0}; EventType = 1; Name = "SCM Event Log Consumer"; NameOfUserSIDProperty = "sid"; SourceName = "Service Control Manager"; }; 586100004611686018427387904326Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9682948WIN-5T344G8GM1HS-1-5-181/19/2018 9:26:51 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2 : Msvm_VirtualDiskChangedRange; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904325Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9682820WIN-5T344G8GM1HS-1-5-181/19/2018 9:26:50 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2 : Msvm_VHDSSnapshotInformation; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904324Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9682820WIN-5T344G8GM1HS-1-5-181/19/2018 9:26:50 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2 : Msvm_VHDSetInformation; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904323Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9682820WIN-5T344G8GM1HS-1-5-181/19/2018 9:26:50 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2 : Msvm_VirtualHardDiskSettingData; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904322Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9682820WIN-5T344G8GM1HS-1-5-181/19/2018 9:26:50 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2 : Msvm_VirtualHardDiskInfo; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904321Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9682820WIN-5T344G8GM1HS-1-5-181/19/2018 9:26:50 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2 : Msvm_SummaryInformationBase; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904320Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9682820WIN-5T344G8GM1HS-1-5-181/19/2018 9:26:50 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2 : Msvm_ServicingSettings; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904319Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9682820WIN-5T344G8GM1HS-1-5-181/19/2018 9:26:50 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2 : CIM_SettingsDefineState; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904318Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9682820WIN-5T344G8GM1HS-1-5-181/19/2018 9:26:50 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2 : CIM_ServiceAffectsElement; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904317Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9682820WIN-5T344G8GM1HS-1-5-181/19/2018 9:26:50 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2 : CIM_ManagedElement; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904316Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9682820WIN-5T344G8GM1HS-1-5-181/19/2018 9:26:50 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2 : CIM_ElementSettingData; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904315Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9682820WIN-5T344G8GM1HS-1-5-181/19/2018 9:26:50 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2 : CIM_ElementCapabilities; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904314Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9682820WIN-5T344G8GM1HS-1-5-181/19/2018 9:26:50 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2 : CIM_Dependency; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904313Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9682820WIN-5T344G8GM1HS-1-5-181/19/2018 9:26:50 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2 : CIM_Component; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904312Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9682820WIN-5T344G8GM1HS-1-5-181/19/2018 9:26:50 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2 : CIM_AffectedJobElement; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904311Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9682820WIN-5T344G8GM1HS-1-5-181/19/2018 9:26:50 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2\ms_409 : Msvm_VirtualDiskChangedRange; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904310Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9682820WIN-5T344G8GM1HS-1-5-181/19/2018 9:26:49 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2\ms_409 : Msvm_VHDSSnapshotInformation; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904309Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9682820WIN-5T344G8GM1HS-1-5-181/19/2018 9:26:49 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2\ms_409 : Msvm_VHDSetInformation; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904308Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9682820WIN-5T344G8GM1HS-1-5-181/19/2018 9:26:49 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2\ms_409 : Msvm_VirtualHardDiskSettingData; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904307Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9682820WIN-5T344G8GM1HS-1-5-181/19/2018 9:26:49 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2\ms_409 : Msvm_VirtualHardDiskInfo; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904306Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9682820WIN-5T344G8GM1HS-1-5-181/19/2018 9:26:49 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2\ms_409 : Msvm_SummaryInformationBase; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904305Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9682820WIN-5T344G8GM1HS-1-5-181/19/2018 9:26:49 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2\ms_409 : Msvm_ServicingSettings; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904304Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9682820WIN-5T344G8GM1HS-1-5-181/19/2018 9:26:49 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2\ms_409 : CIM_SettingsDefineState; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904303Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9682820WIN-5T344G8GM1HS-1-5-181/19/2018 9:26:49 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2\ms_409 : CIM_ServiceAffectsElement; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904302Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9682820WIN-5T344G8GM1HS-1-5-181/19/2018 9:26:49 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2\ms_409 : CIM_ManagedElement; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904301Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9682820WIN-5T344G8GM1HS-1-5-181/19/2018 9:26:49 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2\ms_409 : CIM_ElementSettingData; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904300Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9682820WIN-5T344G8GM1HS-1-5-181/19/2018 9:26:49 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2\ms_409 : CIM_ElementCapabilities; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904299Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9682820WIN-5T344G8GM1HS-1-5-181/19/2018 9:26:49 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2\ms_409 : CIM_Dependency; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904298Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9682820WIN-5T344G8GM1HS-1-5-181/19/2018 9:26:49 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2\ms_409 : CIM_Component; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904297Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9682820WIN-5T344G8GM1HS-1-5-181/19/2018 9:26:49 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2\ms_409 : CIM_AffectedJobElement; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904296Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9682820WIN-5T344G8GM1HS-1-5-181/19/2018 9:26:49 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
MSVDS__PROVIDER provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2840; ProviderPath = %systemroot%\system32\wbem\vdswmi.dll585700004611686018427387904295Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational28402880WIN-5T344G8GM1HS-1-5-201/19/2018 9:26:46 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32a provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2840; ProviderPath = %systemroot%\system32\wbem\wmipcima.dll585700004611686018427387904294Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational28402880WIN-5T344G8GM1HS-1-5-201/19/2018 9:26:44 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2840; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll585700004611686018427387904293Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational28402864WIN-5T344G8GM1HS-1-5-201/19/2018 9:26:42 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 308; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_ComputerSystem; ResultCode = 0x80041032; PossibleCause = Unknown585802004611686018427387904292Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562620WIN-5T344G8GM1HS-1-5-181/19/2018 9:25:03 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 308; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_ComputerSystem; ResultCode = 0x80041032; PossibleCause = Unknown585802004611686018427387904291Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational956404WIN-5T344G8GM1HS-1-5-181/19/2018 9:25:02 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2528; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll585700004611686018427387904290Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational25283456WIN-5T344G8GM1HS-1-5-181/19/2018 9:24:56 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
nettcpip provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2508; ProviderPath = %systemroot%\system32\wbem\NetTCPIP.dll585700004611686018427387904289Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational25084092WIN-5T344G8GM1HS-1-5-201/19/2018 9:24:53 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NetAdapterCim provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2736; ProviderPath = %systemroot%\system32\wbem\NetAdapterCim.dll585700004611686018427387904288Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational27363804WIN-5T344G8GM1HS-1-5-191/19/2018 9:24:53 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2508; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll585700004611686018427387904287Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational25084092WIN-5T344G8GM1HS-1-5-201/19/2018 9:24:53 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2508; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll585700004611686018427387904286Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational25082824WIN-5T344G8GM1HS-1-5-201/19/2018 9:24:53 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3200; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll585700004611686018427387904285Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational32003644WIN-5T344G8GM1HS-1-5-181/19/2018 9:23:15 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
nettcpip provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2856; ProviderPath = %systemroot%\system32\wbem\NetTCPIP.dll585700004611686018427387904284Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational28562920WIN-5T344G8GM1HS-1-5-201/19/2018 9:23:12 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NetAdapterCim provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2540; ProviderPath = %systemroot%\system32\wbem\NetAdapterCim.dll585700004611686018427387904283Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational25403240WIN-5T344G8GM1HS-1-5-191/19/2018 9:23:12 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2856; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll585700004611686018427387904282Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational28562884WIN-5T344G8GM1HS-1-5-201/19/2018 9:23:11 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
MSVDS__PROVIDER provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2856; ProviderPath = %systemroot%\system32\wbem\vdswmi.dll585700004611686018427387904281Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational28562884WIN-5T344G8GM1HS-1-5-201/19/2018 9:23:05 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32a provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2856; ProviderPath = %systemroot%\system32\wbem\wmipcima.dll585700004611686018427387904280Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational28562884WIN-5T344G8GM1HS-1-5-201/19/2018 9:23:04 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Namespace = //./root/CIMV2; NotificationQuery = select * from MSFT_SCMEventLogEvent; OwnerName = S-1-5-32-544; HostProcessID = 956; Provider= SCM Event Provider, queryID = 0; PossibleCause = Permanent585900004611686018427387904279Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562916WIN-5T344G8GM1HS-1-5-181/19/2018 9:23:03 AM17f2f0cc-9107-0002-12f1-f2170791d301microsoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Namespace = //./root/subscription; Eventfilter = SCM Event Log Filter (refer to its activate eventid:5859); Consumer = NTEventLogEventConsumer="SCM Event Log Consumer"; PossibleCause = Binding EventFilter: instance of __EventFilter { CreatorSID = {1, 2, 0, 0, 0, 0, 0, 5, 32, 0, 0, 0, 32, 2, 0, 0}; EventNamespace = "root\\cimv2"; Name = "SCM Event Log Filter"; Query = "select * from MSFT_SCMEventLogEvent"; QueryLanguage = "WQL"; }; Perm. Consumer: instance of NTEventLogEventConsumer { Category = 0; CreatorSID = {1, 2, 0, 0, 0, 0, 0, 5, 32, 0, 0, 0, 32, 2, 0, 0}; EventType = 1; Name = "SCM Event Log Consumer"; NameOfUserSIDProperty = "sid"; SourceName = "Service Control Manager"; }; 586100004611686018427387904278Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562908WIN-5T344G8GM1HS-1-5-181/19/2018 9:23:03 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2856; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll585700004611686018427387904277Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational28562884WIN-5T344G8GM1HS-1-5-201/19/2018 9:23:02 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3808; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll585700004611686018427387904276Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational38084032WIN-5T344G8GM1HS-1-5-181/19/2018 9:14:59 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
nettcpip provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2664; ProviderPath = %systemroot%\system32\wbem\NetTCPIP.dll585700004611686018427387904275Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational26642720WIN-5T344G8GM1HS-1-5-201/19/2018 9:14:58 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NetAdapterCim provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2972; ProviderPath = %systemroot%\system32\wbem\NetAdapterCim.dll585700004611686018427387904274Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational2972156WIN-5T344G8GM1HS-1-5-191/19/2018 9:14:58 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2664; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll585700004611686018427387904273Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational26642720WIN-5T344G8GM1HS-1-5-201/19/2018 9:14:57 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2664; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll585700004611686018427387904272Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational26641584WIN-5T344G8GM1HS-1-5-201/19/2018 9:14:57 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = WIN-5T344G8GM1H\Administrator; ClientProcessId = 1860; Component = Unknown; Operation = Start IWbemServices::PutInstance - root\cimv2 : Win32_ComputerSystem.Name="WIN-5T344G8GM1H"; ResultCode = 0x80041001; PossibleCause = Unknown585802004611686018427387904271Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational11804136WIN-5T344G8GM1HS-1-5-181/19/2018 9:11:39 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4368; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll585700004611686018427387904270Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational43684496WIN-5T344G8GM1HS-1-5-201/19/2018 9:10:55 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1784; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll585700004611686018427387904269Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational17842240WIN-5T344G8GM1HS-1-5-181/19/2018 9:05:00 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
nettcpip provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 952; ProviderPath = %systemroot%\system32\wbem\NetTCPIP.dll585700004611686018427387904268Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational952452WIN-5T344G8GM1HS-1-5-201/19/2018 9:04:58 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NetAdapterCim provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1152; ProviderPath = %systemroot%\system32\wbem\NetAdapterCim.dll585700004611686018427387904267Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational11521396WIN-5T344G8GM1HS-1-5-191/19/2018 9:04:58 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 952; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll585700004611686018427387904266Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational952452WIN-5T344G8GM1HS-1-5-201/19/2018 9:04:57 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 952; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll585700004611686018427387904265Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9521000WIN-5T344G8GM1HS-1-5-201/19/2018 9:04:57 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WMIProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3176; ProviderPath = %systemroot%\system32\wbem\wmiprov.dll585700004611686018427387904264Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational31763364WIN-5T344G8GM1HS-1-5-181/19/2018 8:58:49 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
MSVDS__PROVIDER provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4672; ProviderPath = %systemroot%\system32\wbem\vdswmi.dll585700004611686018427387904263Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational46724700WIN-5T344G8GM1HS-1-5-201/19/2018 8:57:50 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4672; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll585700004611686018427387904262Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational46724700WIN-5T344G8GM1HS-1-5-201/19/2018 8:57:50 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 88; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_ComputerSystemProduct; ResultCode = 0x80041032; PossibleCause = Unknown585802004611686018427387904261Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational11801284WIN-5T344G8GM1HS-1-5-181/19/2018 8:56:50 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4672; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll585700004611686018427387904260Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational46724700WIN-5T344G8GM1HS-1-5-201/19/2018 8:56:50 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Namespace = //./root/CIMV2; NotificationQuery = select * from MSFT_SCMEventLogEvent; OwnerName = S-1-5-32-544; HostProcessID = 1180; Provider= SCM Event Provider, queryID = 0; PossibleCause = Permanent585900004611686018427387904259Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational11804340WIN-5T344G8GM1HS-1-5-181/19/2018 8:56:46 AM289cfce6-9103-0003-f9fd-9c280391d301microsoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Namespace = //./root/subscription; Eventfilter = SCM Event Log Filter (refer to its activate eventid:5859); Consumer = NTEventLogEventConsumer="SCM Event Log Consumer"; PossibleCause = Binding EventFilter: instance of __EventFilter { CreatorSID = {1, 2, 0, 0, 0, 0, 0, 5, 32, 0, 0, 0, 32, 2, 0, 0}; EventNamespace = "root\\cimv2"; Name = "SCM Event Log Filter"; Query = "select * from MSFT_SCMEventLogEvent"; QueryLanguage = "WQL"; }; Perm. Consumer: instance of NTEventLogEventConsumer { Category = 0; CreatorSID = {1, 2, 0, 0, 0, 0, 0, 5, 32, 0, 0, 0, 32, 2, 0, 0}; EventType = 1; Name = "SCM Event Log Consumer"; NameOfUserSIDProperty = "sid"; SourceName = "Service Control Manager"; }; 586100004611686018427387904258Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational11804340WIN-5T344G8GM1HS-1-5-181/19/2018 8:56:46 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
MSVDS__PROVIDER provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3968; ProviderPath = %systemroot%\system32\wbem\vdswmi.dll585700004611686018427387904257Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational39684008WIN-5T344G8GM1HS-1-5-201/19/2018 8:55:06 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32a provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3968; ProviderPath = %systemroot%\system32\wbem\wmipcima.dll585700004611686018427387904256Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational39684008WIN-5T344G8GM1HS-1-5-201/19/2018 8:55:05 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3688; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll585700004611686018427387904255Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational36883696WIN-5T344G8GM1HS-1-5-181/19/2018 8:55:04 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
nettcpip provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3968; ProviderPath = %systemroot%\system32\wbem\NetTCPIP.dll585700004611686018427387904254Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational39684020WIN-5T344G8GM1HS-1-5-201/19/2018 8:54:58 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NetAdapterCim provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4024; ProviderPath = %systemroot%\system32\wbem\NetAdapterCim.dll585700004611686018427387904253Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational40244052WIN-5T344G8GM1HS-1-5-191/19/2018 8:54:58 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3968; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll585700004611686018427387904252Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational39684008WIN-5T344G8GM1HS-1-5-201/19/2018 8:54:58 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3968; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll585700004611686018427387904251Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational39683996WIN-5T344G8GM1HS-1-5-201/19/2018 8:54:58 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3880; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll585700004611686018427387904250Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational38803916WIN-5T344G8GM1HS-1-5-201/19/2018 8:54:38 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {7C5C4FFB-9102-0000-4A51-5C7C0291D301}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 1192; Component = Unknown; Operation = Start IWbemServices::ExecNotificationQuery - ROOT\CIMV2 : SELECT * FROM Win32_ProcessStartTrace WHERE ProcessName = 'wsmprovhost.exe'; ResultCode = 0x80041032; PossibleCause = Unknown585802004611686018427387904249Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational11923004WIN-5T344G8GM1HS-1-5-181/19/2018 8:54:34 AM7c5c4ffb-9102-0000-4a51-5c7c0291d301microsoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WMIProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1200; ProviderPath = %systemroot%\system32\wbem\wmiprov.dll585700004611686018427387904248Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational12002840WIN-5T344G8GM1HS-1-5-181/19/2018 8:54:03 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Namespace = ROOT\CIMV2; NotificationQuery = SELECT * FROM Win32_ProcessStartTrace WHERE ProcessName = 'wsmprovhost.exe'; UserName = ; ClientProcessID = 1192, ClientMachine = WIN-5T344G8GM1H; PossibleCause = Temporary586000004611686018427387904247Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational11922792WIN-5T344G8GM1HS-1-5-181/19/2018 8:52:27 AM7c5c4ffb-9102-0001-8851-5c7c0291d301microsoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WMI Kernel Trace Event Provider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1192; ProviderPath = C:\Windows\System32\wbem\krnlprov.dll585700004611686018427387904246Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational11922792WIN-5T344G8GM1HS-1-5-181/19/2018 8:52:27 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Namespace = //./root/CIMV2; NotificationQuery = select * from MSFT_SCMEventLogEvent; OwnerName = S-1-5-32-544; HostProcessID = 1192; Provider= SCM Event Provider, queryID = 0; PossibleCause = Permanent585900004611686018427387904245Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational11922796WIN-5T344G8GM1HS-1-5-181/19/2018 8:51:57 AM7c5c4ffb-9102-0001-5f51-5c7c0291d301microsoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Namespace = //./root/subscription; Eventfilter = SCM Event Log Filter (refer to its activate eventid:5859); Consumer = NTEventLogEventConsumer="SCM Event Log Consumer"; PossibleCause = Binding EventFilter: instance of __EventFilter { CreatorSID = {1, 2, 0, 0, 0, 0, 0, 5, 32, 0, 0, 0, 32, 2, 0, 0}; EventNamespace = "root\\cimv2"; Name = "SCM Event Log Filter"; Query = "select * from MSFT_SCMEventLogEvent"; QueryLanguage = "WQL"; }; Perm. Consumer: instance of NTEventLogEventConsumer { Category = 0; CreatorSID = {1, 2, 0, 0, 0, 0, 0, 5, 32, 0, 0, 0, 32, 2, 0, 0}; EventType = 1; Name = "SCM Event Log Consumer"; NameOfUserSIDProperty = "sid"; SourceName = "Service Control Manager"; }; 586100004611686018427387904244Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational11922796WIN-5T344G8GM1HS-1-5-181/19/2018 8:51:57 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
MSVDS__PROVIDER provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3832; ProviderPath = %systemroot%\system32\wbem\vdswmi.dll585700004611686018427387904243Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational38323932WIN-5T344G8GM1HS-1-5-201/19/2018 8:51:38 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32a provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3832; ProviderPath = %systemroot%\system32\wbem\wmipcima.dll585700004611686018427387904242Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational38323872WIN-5T344G8GM1HS-1-5-201/19/2018 8:51:37 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 428; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll585700004611686018427387904241Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational4281316WIN-5T344G8GM1HS-1-5-181/19/2018 8:51:13 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
nettcpip provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3832; ProviderPath = %systemroot%\system32\wbem\NetTCPIP.dll585700004611686018427387904240Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational38323872WIN-5T344G8GM1HS-1-5-201/19/2018 8:51:04 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NetAdapterCim provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3888; ProviderPath = %systemroot%\system32\wbem\NetAdapterCim.dll585700004611686018427387904239Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational38883916WIN-5T344G8GM1HS-1-5-191/19/2018 8:51:04 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3832; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll585700004611686018427387904238Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational38323872WIN-5T344G8GM1HS-1-5-201/19/2018 8:51:04 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3832; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll585700004611686018427387904237Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational38323860WIN-5T344G8GM1HS-1-5-201/19/2018 8:51:04 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4796; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll585700004611686018427387904236Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational4796840WIN-5T344G8GM1HS-1-5-201/19/2018 8:45:55 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2284; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll585700004611686018427387904235Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational22842676WIN-5T344G8GM1HS-1-5-181/19/2018 8:44:15 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
nettcpip provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2548; ProviderPath = %systemroot%\system32\wbem\NetTCPIP.dll585700004611686018427387904234Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational25482728WIN-5T344G8GM1HS-1-5-201/19/2018 8:44:08 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NetAdapterCim provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2300; ProviderPath = %systemroot%\system32\wbem\NetAdapterCim.dll585700004611686018427387904233Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational23004360WIN-5T344G8GM1HS-1-5-191/19/2018 8:44:08 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2548; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll585700004611686018427387904232Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational25482728WIN-5T344G8GM1HS-1-5-201/19/2018 8:44:08 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2548; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll585700004611686018427387904231Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational25483736WIN-5T344G8GM1HS-1-5-201/19/2018 8:44:08 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1052; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll585700004611686018427387904230Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational10524868WIN-5T344G8GM1HS-1-5-201/19/2018 8:36:56 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3184; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll585700004611686018427387904229Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational3184404WIN-5T344G8GM1HS-1-5-181/19/2018 8:34:15 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Win32_WIN32_TERMINALSERVICE_Prov provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1164; ProviderPath = %SystemRoot%\system32\tscfgwmi.dll585700004611686018427387904228Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational11644616WIN-5T344G8GM1HS-1-5-201/19/2018 8:34:14 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4600; Component = Unknown; Operation = Start IWbemServices::ExecQuery - ROOT\WMI : SELECT * FROM BatteryStaticData; ResultCode = 0x80041010; PossibleCause = Unknown585802004611686018427387904227Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9644904WIN-5T344G8GM1HS-1-5-181/19/2018 8:34:14 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4600; Component = Unknown; Operation = Start IWbemServices::ExecQuery - ROOT\WMI : SELECT * FROM BatteryFullChargedCapacity; ResultCode = 0x80041010; PossibleCause = Unknown585802004611686018427387904226Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9644904WIN-5T344G8GM1HS-1-5-181/19/2018 8:34:13 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
PowerWmiProvider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1164; ProviderPath = %SYSTEMROOT%\system32\PowerWmiProvider.dll585700004611686018427387904225Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational11641368WIN-5T344G8GM1HS-1-5-201/19/2018 8:34:13 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
StorageWMI provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1164; ProviderPath = %SystemRoot%\System32\storagewmi.dll585700004611686018427387904224Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational11641368WIN-5T344G8GM1HS-1-5-201/19/2018 8:34:11 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
MSVDS__PROVIDER provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1164; ProviderPath = %systemroot%\system32\wbem\vdswmi.dll585700004611686018427387904223Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational11641368WIN-5T344G8GM1HS-1-5-201/19/2018 8:34:11 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
nettcpip provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1164; ProviderPath = %systemroot%\system32\wbem\NetTCPIP.dll585700004611686018427387904222Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational11641368WIN-5T344G8GM1HS-1-5-201/19/2018 8:34:08 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NetAdapterCim provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2920; ProviderPath = %systemroot%\system32\wbem\NetAdapterCim.dll585700004611686018427387904221Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational29204532WIN-5T344G8GM1HS-1-5-191/19/2018 8:34:08 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1164; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll585700004611686018427387904220Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational11641368WIN-5T344G8GM1HS-1-5-201/19/2018 8:34:08 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1164; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll585700004611686018427387904219Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational11641532WIN-5T344G8GM1HS-1-5-201/19/2018 8:34:08 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9A81CB05-910F-0003-8ACC-819A0F91D301}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 964; Component = Unknown; Operation = Start IWbemServices::ExecNotificationQuery - ROOT\CIMV2 : SELECT * FROM Win32_ProcessStartTrace WHERE ProcessName = 'wsmprovhost.exe'; ResultCode = 0x80041032; PossibleCause = Unknown585802004611686018427387904218Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9644228WIN-5T344G8GM1HS-1-5-181/19/2018 8:33:15 AM9a81cb05-910f-0003-8acc-819a0f91d301microsoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3976; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\Microsoft\Windows\DeviceGuard : SELECT RequiredSecurityProperties FROM Win32_DeviceGuard ; ResultCode = 0x80041032; PossibleCause = Unknown585802004611686018427387904217Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9641824WIN-5T344G8GM1HS-1-5-181/19/2018 8:33:01 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3976; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\Microsoft\Windows\DeviceGuard : SELECT SecurityServicesConfigured FROM Win32_DeviceGuard ; ResultCode = 0x80041032; PossibleCause = Unknown585802004611686018427387904216Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9645076WIN-5T344G8GM1HS-1-5-181/19/2018 8:33:01 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Win32_TpmProvider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1164; ProviderPath = C:\Windows\system32\wbem\Win32_TPM.dll585700004611686018427387904215Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational11641532WIN-5T344G8GM1HS-1-5-201/19/2018 8:33:01 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3976; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\Microsoft\Windows\DeviceGuard : SELECT VirtualizationBasedSecurityStatus FROM Win32_DeviceGuard ; ResultCode = 0x80041032; PossibleCause = Unknown585802004611686018427387904214Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9645076WIN-5T344G8GM1HS-1-5-181/19/2018 8:33:01 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3976; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\Microsoft\Windows\DeviceGuard : SELECT SecurityServicesRunning FROM Win32_DeviceGuard ; ResultCode = 0x80041032; PossibleCause = Unknown585802004611686018427387904213Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9645076WIN-5T344G8GM1HS-1-5-181/19/2018 8:33:01 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3976; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\Microsoft\Windows\DeviceGuard : SELECT AvailableSecurityProperties FROM Win32_DeviceGuard ; ResultCode = 0x80041032; PossibleCause = Unknown585802004611686018427387904212Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9641824WIN-5T344G8GM1HS-1-5-181/19/2018 8:33:01 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3976; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\Microsoft\Windows\DeviceGuard : SELECT RequiredSecurityProperties FROM Win32_DeviceGuard ; ResultCode = 0x80041032; PossibleCause = Unknown585802004611686018427387904211Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9645076WIN-5T344G8GM1HS-1-5-181/19/2018 8:33:01 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Win32_DeviceGuard provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1164; ProviderPath = %SystemRoot%\System32\Win32_DeviceGuard.dll585700004611686018427387904210Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational11641532WIN-5T344G8GM1HS-1-5-201/19/2018 8:33:01 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3976; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\CIMV2 : SELECT SMBIOSAssetTag FROM Win32_SystemEnclosure ; ResultCode = 0x80041032; PossibleCause = Unknown585802004611686018427387904209Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9645076WIN-5T344G8GM1HS-1-5-181/19/2018 8:32:59 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
MSVDS__PROVIDER provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1164; ProviderPath = %systemroot%\system32\wbem\vdswmi.dll585700004611686018427387904208Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational11641532WIN-5T344G8GM1HS-1-5-201/19/2018 8:32:59 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1164; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll585700004611686018427387904207Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational11642868WIN-5T344G8GM1HS-1-5-201/19/2018 8:32:58 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1912; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll585700004611686018427387904206Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational19123084WIN-5T344G8GM1HS-1-5-181/19/2018 8:32:58 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
ServerFeatureProvider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1164; ProviderPath = %windir%\system32\wbem\servercompprov.dll585700004611686018427387904205Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational11641532WIN-5T344G8GM1HS-1-5-201/19/2018 8:32:58 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
MSVDS__PROVIDER provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 996; ProviderPath = %systemroot%\system32\wbem\vdswmi.dll585700004611686018427387904204Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational996456WIN-5T344G8GM1HS-1-5-201/19/2018 8:29:00 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 996; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll585700004611686018427387904203Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational996456WIN-5T344G8GM1HS-1-5-201/19/2018 8:29:00 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WMIProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4324; ProviderPath = %systemroot%\system32\wbem\wmiprov.dll585700004611686018427387904202Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational43243568WIN-5T344G8GM1HS-1-5-181/19/2018 8:27:56 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Namespace = ROOT\CIMV2; NotificationQuery = SELECT * FROM Win32_ProcessStartTrace WHERE ProcessName = 'wsmprovhost.exe'; UserName = ; ClientProcessID = 964, ClientMachine = WIN-5T344G8GM1H; PossibleCause = Temporary586000004611686018427387904201Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9643260WIN-5T344G8GM1HS-1-5-181/19/2018 8:26:55 AM9a81cb05-910f-0000-a4cc-819a0f91d301microsoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WMI Kernel Trace Event Provider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 964; ProviderPath = C:\Windows\System32\wbem\krnlprov.dll585700004611686018427387904200Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9643260WIN-5T344G8GM1HS-1-5-181/19/2018 8:26:55 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
MSVDS__PROVIDER provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3772; ProviderPath = %systemroot%\system32\wbem\vdswmi.dll585700004611686018427387904199Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational37723768WIN-5T344G8GM1HS-1-5-201/19/2018 8:26:50 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3772; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll585700004611686018427387904198Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational37723768WIN-5T344G8GM1HS-1-5-201/19/2018 8:25:57 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Namespace = //./root/CIMV2; NotificationQuery = select * from MSFT_SCMEventLogEvent; OwnerName = S-1-5-32-544; HostProcessID = 964; Provider= SCM Event Provider, queryID = 0; PossibleCause = Permanent585900004611686018427387904197Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9644648WIN-5T344G8GM1HS-1-5-181/19/2018 8:25:52 AM9a81cb05-910f-0003-4bcc-819a0f91d301microsoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Namespace = //./root/subscription; Eventfilter = SCM Event Log Filter (refer to its activate eventid:5859); Consumer = NTEventLogEventConsumer="SCM Event Log Consumer"; PossibleCause = Binding EventFilter: instance of __EventFilter { CreatorSID = {1, 2, 0, 0, 0, 0, 0, 5, 32, 0, 0, 0, 32, 2, 0, 0}; EventNamespace = "root\\cimv2"; Name = "SCM Event Log Filter"; Query = "select * from MSFT_SCMEventLogEvent"; QueryLanguage = "WQL"; }; Perm. Consumer: instance of NTEventLogEventConsumer { Category = 0; CreatorSID = {1, 2, 0, 0, 0, 0, 0, 5, 32, 0, 0, 0, 32, 2, 0, 0}; EventType = 1; Name = "SCM Event Log Consumer"; NameOfUserSIDProperty = "sid"; SourceName = "Service Control Manager"; }; 586100004611686018427387904196Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9644648WIN-5T344G8GM1HS-1-5-181/19/2018 8:25:52 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
MSVDS__PROVIDER provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3772; ProviderPath = %systemroot%\system32\wbem\vdswmi.dll585700004611686018427387904195Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational37723768WIN-5T344G8GM1HS-1-5-201/19/2018 8:24:46 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4124; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll585700004611686018427387904194Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational41244152WIN-5T344G8GM1HS-1-5-181/19/2018 8:24:15 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
nettcpip provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3772; ProviderPath = %systemroot%\system32\wbem\NetTCPIP.dll585700004611686018427387904193Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational37723820WIN-5T344G8GM1HS-1-5-201/19/2018 8:24:08 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NetAdapterCim provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3084; ProviderPath = %systemroot%\system32\wbem\NetAdapterCim.dll585700004611686018427387904192Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational30843436WIN-5T344G8GM1HS-1-5-191/19/2018 8:24:08 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3772; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll585700004611686018427387904191Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational37723800WIN-5T344G8GM1HS-1-5-201/19/2018 8:24:08 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32a provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3772; ProviderPath = %systemroot%\system32\wbem\wmipcima.dll585700004611686018427387904190Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational37723800WIN-5T344G8GM1HS-1-5-201/19/2018 8:24:03 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3772; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll585700004611686018427387904189Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational37723800WIN-5T344G8GM1HS-1-5-201/19/2018 8:24:03 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3868; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll585700004611686018427387904188Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational38683176WIN-5T344G8GM1HS-1-5-181/16/2018 6:37:16 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
nettcpip provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2504; ProviderPath = %systemroot%\system32\wbem\NetTCPIP.dll585700004611686018427387904187Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational25042192WIN-5T344G8GM1HS-1-5-201/16/2018 6:37:14 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NetAdapterCim provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2788; ProviderPath = %systemroot%\system32\wbem\NetAdapterCim.dll585700004611686018427387904186Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational27882624WIN-5T344G8GM1HS-1-5-191/16/2018 6:37:14 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2504; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll585700004611686018427387904185Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational25042192WIN-5T344G8GM1HS-1-5-201/16/2018 6:37:14 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2504; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll585700004611686018427387904184Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational25042440WIN-5T344G8GM1HS-1-5-201/16/2018 6:37:14 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4024; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll585700004611686018427387904183Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational40243868WIN-5T344G8GM1HS-1-5-181/16/2018 6:27:16 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
nettcpip provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1288; ProviderPath = %systemroot%\system32\wbem\NetTCPIP.dll585700004611686018427387904182Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational12883280WIN-5T344G8GM1HS-1-5-201/16/2018 6:27:14 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NetAdapterCim provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1500; ProviderPath = %systemroot%\system32\wbem\NetAdapterCim.dll585700004611686018427387904181Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational15002664WIN-5T344G8GM1HS-1-5-191/16/2018 6:27:14 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1288; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll585700004611686018427387904180Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational12883280WIN-5T344G8GM1HS-1-5-201/16/2018 6:27:14 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1288; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll585700004611686018427387904179Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational12884056WIN-5T344G8GM1HS-1-5-201/16/2018 6:27:14 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 652; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll585700004611686018427387904178Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6521972WIN-5T344G8GM1HS-1-5-181/16/2018 6:17:16 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
nettcpip provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4032; ProviderPath = %systemroot%\system32\wbem\NetTCPIP.dll585700004611686018427387904177Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational40323152WIN-5T344G8GM1HS-1-5-201/16/2018 6:17:14 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NetAdapterCim provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3688; ProviderPath = %systemroot%\system32\wbem\NetAdapterCim.dll585700004611686018427387904176Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational36883124WIN-5T344G8GM1HS-1-5-191/16/2018 6:17:14 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4032; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll585700004611686018427387904175Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational40321184WIN-5T344G8GM1HS-1-5-201/16/2018 6:17:14 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4032; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll585700004611686018427387904174Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational40321160WIN-5T344G8GM1HS-1-5-201/16/2018 6:17:14 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WMIProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1088; ProviderPath = %systemroot%\system32\wbem\wmiprov.dll585700004611686018427387904173Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational10884088WIN-5T344G8GM1HS-1-5-181/16/2018 6:10:25 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2784; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll585700004611686018427387904172Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational27841752WIN-5T344G8GM1HS-1-5-201/16/2018 6:08:29 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Namespace = //./root/CIMV2; NotificationQuery = select * from MSFT_SCMEventLogEvent; OwnerName = S-1-5-32-544; HostProcessID = 1176; Provider= SCM Event Provider, queryID = 0; PossibleCause = Permanent585900004611686018427387904171Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational11763928WIN-5T344G8GM1HS-1-5-181/16/2018 6:08:20 PMb65c0852-8ef4-0003-8709-5cb6f48ed301microsoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Namespace = //./root/subscription; Eventfilter = SCM Event Log Filter (refer to its activate eventid:5859); Consumer = NTEventLogEventConsumer="SCM Event Log Consumer"; PossibleCause = Binding EventFilter: instance of __EventFilter { CreatorSID = {1, 2, 0, 0, 0, 0, 0, 5, 32, 0, 0, 0, 32, 2, 0, 0}; EventNamespace = "root\\cimv2"; Name = "SCM Event Log Filter"; Query = "select * from MSFT_SCMEventLogEvent"; QueryLanguage = "WQL"; }; Perm. Consumer: instance of NTEventLogEventConsumer { Category = 0; CreatorSID = {1, 2, 0, 0, 0, 0, 0, 5, 32, 0, 0, 0, 32, 2, 0, 0}; EventType = 1; Name = "SCM Event Log Consumer"; NameOfUserSIDProperty = "sid"; SourceName = "Service Control Manager"; }; 586100004611686018427387904170Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational11763928WIN-5T344G8GM1HS-1-5-181/16/2018 6:08:20 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
MSVDS__PROVIDER provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2784; ProviderPath = %systemroot%\system32\wbem\vdswmi.dll585700004611686018427387904169Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational27841752WIN-5T344G8GM1HS-1-5-201/16/2018 6:07:37 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32a provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2784; ProviderPath = %systemroot%\system32\wbem\wmipcima.dll585700004611686018427387904168Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational27841752WIN-5T344G8GM1HS-1-5-201/16/2018 6:07:36 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
nettcpip provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2784; ProviderPath = %systemroot%\system32\wbem\NetTCPIP.dll585700004611686018427387904167Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational27844072WIN-5T344G8GM1HS-1-5-201/16/2018 6:07:14 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NetAdapterCim provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4076; ProviderPath = %systemroot%\system32\wbem\NetAdapterCim.dll585700004611686018427387904166Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational40761920WIN-5T344G8GM1HS-1-5-191/16/2018 6:07:14 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2784; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll585700004611686018427387904165Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational27844060WIN-5T344G8GM1HS-1-5-201/16/2018 6:07:14 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2784; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll585700004611686018427387904164Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational27842824WIN-5T344G8GM1HS-1-5-201/16/2018 6:07:14 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 2584; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\Microsoft\Windows\DeviceGuard : SELECT AvailableSecurityProperties FROM Win32_DeviceGuard ; ResultCode = 0x80041032; PossibleCause = Unknown585802004611686018427387904163Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational11762580WIN-5T344G8GM1HS-1-5-181/16/2018 6:06:34 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 2584; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\Microsoft\Windows\DeviceGuard : SELECT RequiredSecurityProperties FROM Win32_DeviceGuard ; ResultCode = 0x80041032; PossibleCause = Unknown585802004611686018427387904162Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational11762580WIN-5T344G8GM1HS-1-5-181/16/2018 6:06:34 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 2584; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\Microsoft\Windows\DeviceGuard : SELECT SecurityServicesConfigured FROM Win32_DeviceGuard ; ResultCode = 0x80041032; PossibleCause = Unknown585802004611686018427387904161Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational11762640WIN-5T344G8GM1HS-1-5-181/16/2018 6:06:34 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Win32_TpmProvider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2784; ProviderPath = C:\Windows\system32\wbem\Win32_TPM.dll585700004611686018427387904160Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational27842824WIN-5T344G8GM1HS-1-5-201/16/2018 6:06:34 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 2584; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\Microsoft\Windows\DeviceGuard : SELECT VirtualizationBasedSecurityStatus FROM Win32_DeviceGuard ; ResultCode = 0x80041032; PossibleCause = Unknown585802004611686018427387904159Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational11762640WIN-5T344G8GM1HS-1-5-181/16/2018 6:06:33 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 2584; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\Microsoft\Windows\DeviceGuard : SELECT SecurityServicesRunning FROM Win32_DeviceGuard ; ResultCode = 0x80041032; PossibleCause = Unknown585802004611686018427387904158Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational11762580WIN-5T344G8GM1HS-1-5-181/16/2018 6:06:33 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 2584; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\Microsoft\Windows\DeviceGuard : SELECT SecurityServicesRunning FROM Win32_DeviceGuard ; ResultCode = 0x80041032; PossibleCause = Unknown585802004611686018427387904157Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational11762580WIN-5T344G8GM1HS-1-5-181/16/2018 6:06:33 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 2584; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\Microsoft\Windows\DeviceGuard : SELECT AvailableSecurityProperties FROM Win32_DeviceGuard ; ResultCode = 0x80041032; PossibleCause = Unknown585802004611686018427387904156Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational11762580WIN-5T344G8GM1HS-1-5-181/16/2018 6:06:33 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 2584; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\Microsoft\Windows\DeviceGuard : SELECT RequiredSecurityProperties FROM Win32_DeviceGuard ; ResultCode = 0x80041032; PossibleCause = Unknown585802004611686018427387904155Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational11762580WIN-5T344G8GM1HS-1-5-181/16/2018 6:06:33 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Win32_DeviceGuard provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2784; ProviderPath = %SystemRoot%\System32\Win32_DeviceGuard.dll585700004611686018427387904154Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational27842824WIN-5T344G8GM1HS-1-5-201/16/2018 6:06:33 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 2584; Component = Unknown; Operation = Start IWbemServices::ExecQuery - ROOT\CIMV2 : select ChassisTypes from Win32_SystemEnclosure; ResultCode = 0x80041032; PossibleCause = Unknown585802004611686018427387904153Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational11762640WIN-5T344G8GM1HS-1-5-181/16/2018 6:06:33 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2784; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll585700004611686018427387904152Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational27842824WIN-5T344G8GM1HS-1-5-201/16/2018 6:06:32 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 2584; Component = Unknown; Operation = Start IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT ID FROM Win32_ServerFeature; ResultCode = 0x80041032; PossibleCause = Unknown585802004611686018427387904151Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational11762640WIN-5T344G8GM1HS-1-5-181/16/2018 6:06:32 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2832; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll585700004611686018427387904150Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational28322860WIN-5T344G8GM1HS-1-5-181/16/2018 6:06:27 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
ServerFeatureProvider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2784; ProviderPath = %windir%\system32\wbem\servercompprov.dll585700004611686018427387904149Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational27842812WIN-5T344G8GM1HS-1-5-201/16/2018 6:06:27 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4892; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll585700004611686018427387904148Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational4892836WIN-5T344G8GM1HS-1-5-201/16/2018 6:02:36 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4256; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll585700004611686018427387904147Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational42564144WIN-5T344G8GM1HS-1-5-181/16/2018 5:53:30 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
nettcpip provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4976; ProviderPath = %systemroot%\system32\wbem\NetTCPIP.dll585700004611686018427387904146Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational49763800WIN-5T344G8GM1HS-1-5-201/16/2018 5:53:24 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NetAdapterCim provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 5092; ProviderPath = %systemroot%\system32\wbem\NetAdapterCim.dll585700004611686018427387904145Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational50922628WIN-5T344G8GM1HS-1-5-191/16/2018 5:53:24 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4976; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll585700004611686018427387904144Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational49763800WIN-5T344G8GM1HS-1-5-201/16/2018 5:53:23 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4976; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll585700004611686018427387904143Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational49765116WIN-5T344G8GM1HS-1-5-201/16/2018 5:53:23 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {53B2B737-8EF1-0000-6DB9-B253F18ED301}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 1152; Component = Unknown; Operation = Start IWbemServices::ExecNotificationQuery - ROOT\CIMV2 : SELECT * FROM Win32_ProcessStartTrace WHERE ProcessName = 'wsmprovhost.exe'; ResultCode = 0x80041032; PossibleCause = Unknown585802004611686018427387904142Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational11524780WIN-5T344G8GM1HS-1-5-181/16/2018 5:50:11 PM53b2b737-8ef1-0000-6db9-b253f18ed301microsoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WMIProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3688; ProviderPath = %systemroot%\system32\wbem\wmiprov.dll585700004611686018427387904141Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational36882160WIN-5T344G8GM1HS-1-5-181/16/2018 5:46:15 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Namespace = ROOT\CIMV2; NotificationQuery = SELECT * FROM Win32_ProcessStartTrace WHERE ProcessName = 'wsmprovhost.exe'; UserName = ; ClientProcessID = 1152, ClientMachine = WIN-5T344G8GM1H; PossibleCause = Temporary586000004611686018427387904140Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational11524676WIN-5T344G8GM1HS-1-5-181/16/2018 5:44:23 PM53b2b737-8ef1-0003-feb9-b253f18ed301microsoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WMI Kernel Trace Event Provider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1152; ProviderPath = C:\Windows\System32\wbem\krnlprov.dll585700004611686018427387904139Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational11524676WIN-5T344G8GM1HS-1-5-181/16/2018 5:44:23 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 400; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_ComputerSystemProduct; ResultCode = 0x80041032; PossibleCause = Unknown585802004611686018427387904138Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational11522600WIN-5T344G8GM1HS-1-5-181/16/2018 5:44:12 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4212; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll585700004611686018427387904137Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational42124236WIN-5T344G8GM1HS-1-5-181/16/2018 5:43:31 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
MSVDS__PROVIDER provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 976; ProviderPath = %systemroot%\system32\wbem\vdswmi.dll585700004611686018427387904136Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9762796WIN-5T344G8GM1HS-1-5-201/16/2018 5:43:29 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
nettcpip provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 976; ProviderPath = %systemroot%\system32\wbem\NetTCPIP.dll585700004611686018427387904135Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9763216WIN-5T344G8GM1HS-1-5-201/16/2018 5:43:23 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NetAdapterCim provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3208; ProviderPath = %systemroot%\system32\wbem\NetAdapterCim.dll585700004611686018427387904134Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational32083308WIN-5T344G8GM1HS-1-5-191/16/2018 5:43:23 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 976; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll585700004611686018427387904133Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational976324WIN-5T344G8GM1HS-1-5-201/16/2018 5:43:23 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32a provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 976; ProviderPath = %systemroot%\system32\wbem\wmipcima.dll585700004611686018427387904132Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational976324WIN-5T344G8GM1HS-1-5-201/16/2018 5:43:17 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 976; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll585700004611686018427387904131Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational976324WIN-5T344G8GM1HS-1-5-201/16/2018 5:43:17 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Namespace = //./root/CIMV2; NotificationQuery = select * from MSFT_SCMEventLogEvent; OwnerName = S-1-5-32-544; HostProcessID = 1152; Provider= SCM Event Provider, queryID = 0; PossibleCause = Permanent585900004611686018427387904130Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational11522720WIN-5T344G8GM1HS-1-5-181/16/2018 5:42:38 PM53b2b737-8ef1-0001-8eb7-b253f18ed301microsoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Namespace = //./root/subscription; Eventfilter = SCM Event Log Filter (refer to its activate eventid:5859); Consumer = NTEventLogEventConsumer="SCM Event Log Consumer"; PossibleCause = Binding EventFilter: instance of __EventFilter { CreatorSID = {1, 2, 0, 0, 0, 0, 0, 5, 32, 0, 0, 0, 32, 2, 0, 0}; EventNamespace = "root\\cimv2"; Name = "SCM Event Log Filter"; Query = "select * from MSFT_SCMEventLogEvent"; QueryLanguage = "WQL"; }; Perm. Consumer: instance of NTEventLogEventConsumer { Category = 0; CreatorSID = {1, 2, 0, 0, 0, 0, 0, 5, 32, 0, 0, 0, 32, 2, 0, 0}; EventType = 1; Name = "SCM Event Log Consumer"; NameOfUserSIDProperty = "sid"; SourceName = "Service Control Manager"; }; 586100004611686018427387904129Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational11522720WIN-5T344G8GM1HS-1-5-181/16/2018 5:42:38 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {A4626349-8EA8-0003-B36D-62A4A88ED301}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::ExecNotificationQuery - ROOT\CIMV2 : SELECT * FROM Win32_ProcessStartTrace WHERE ProcessName = 'wsmprovhost.exe'; ResultCode = 0x80041032; PossibleCause = Unknown585802004611686018427387904128Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9243696WIN-5T344G8GM1HS-1-5-181/16/2018 5:37:24 PMa4626349-8ea8-0003-b36d-62a4a88ed301microsoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 164; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll585700004611686018427387904127Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational1643628WIN-5T344G8GM1HS-1-5-201/16/2018 5:35:48 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WmiPerfInst provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3868; ProviderPath = C:\Windows\System32\wbem\WmiPerfInst.dll585700004611686018427387904126Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational38681388WIN-5T344G8GM1HS-1-5-191/16/2018 5:35:07 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WMIProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4924; ProviderPath = %systemroot%\system32\wbem\wmiprov.dll585700004611686018427387904125Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational4924428WIN-5T344G8GM1HS-1-5-181/16/2018 5:35:04 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WmiPerfClass provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4924; ProviderPath = C:\Windows\System32\wbem\WmiPerfClass.dll585700004611686018427387904124Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational49245928WIN-5T344G8GM1HS-1-5-181/16/2018 5:35:03 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Namespace = ROOT\CIMV2; NotificationQuery = SELECT * FROM Win32_ProcessStartTrace WHERE ProcessName = 'wsmprovhost.exe'; UserName = ; ClientProcessID = 924, ClientMachine = WIN-5T344G8GM1H; PossibleCause = Temporary586000004611686018427387904123Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242052WIN-5T344G8GM1HS-1-5-181/16/2018 5:34:06 PMa4626349-8ea8-0002-ed6e-62a4a88ed301microsoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WMI Kernel Trace Event Provider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 924; ProviderPath = C:\Windows\System32\wbem\krnlprov.dll585700004611686018427387904122Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242052WIN-5T344G8GM1HS-1-5-181/16/2018 5:34:06 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 5028; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll585700004611686018427387904121Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational50285328WIN-5T344G8GM1HS-1-5-181/16/2018 5:32:53 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
nettcpip provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 5804; ProviderPath = %systemroot%\system32\wbem\NetTCPIP.dll585700004611686018427387904120Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational58045824WIN-5T344G8GM1HS-1-5-201/16/2018 5:32:40 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NetAdapterCim provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3816; ProviderPath = %systemroot%\system32\wbem\NetAdapterCim.dll585700004611686018427387904119Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational38161224WIN-5T344G8GM1HS-1-5-191/16/2018 5:32:40 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 5804; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll585700004611686018427387904118Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational58045824WIN-5T344G8GM1HS-1-5-201/16/2018 5:32:40 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 5804; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll585700004611686018427387904117Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5804912WIN-5T344G8GM1HS-1-5-201/16/2018 5:32:40 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3180; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll585700004611686018427387904116Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational3180804WIN-5T344G8GM1HS-1-5-181/16/2018 5:22:47 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
nettcpip provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3772; ProviderPath = %systemroot%\system32\wbem\NetTCPIP.dll585700004611686018427387904115Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational37725300WIN-5T344G8GM1HS-1-5-201/16/2018 5:22:40 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NetAdapterCim provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 888; ProviderPath = %systemroot%\system32\wbem\NetAdapterCim.dll585700004611686018427387904114Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational8885288WIN-5T344G8GM1HS-1-5-191/16/2018 5:22:40 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3772; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll585700004611686018427387904113Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational37725300WIN-5T344G8GM1HS-1-5-201/16/2018 5:22:40 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3772; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll585700004611686018427387904112Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational37723704WIN-5T344G8GM1HS-1-5-201/16/2018 5:22:40 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 5964; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll585700004611686018427387904111Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational59643468WIN-5T344G8GM1HS-1-5-181/16/2018 5:12:54 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {A4626349-8EA8-0000-8A6D-62A4A88ED301}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::ExecNotificationQuery - ROOT\CIMV2 : SELECT * FROM Win32_ProcessStartTrace WHERE ProcessName = 'wsmprovhost.exe'; ResultCode = 0x80041032; PossibleCause = Unknown585802004611686018427387904110Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9241992WIN-5T344G8GM1HS-1-5-181/16/2018 5:12:41 PMa4626349-8ea8-0000-8a6d-62a4a88ed301microsoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
nettcpip provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1260; ProviderPath = %systemroot%\system32\wbem\NetTCPIP.dll585700004611686018427387904109Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational12601960WIN-5T344G8GM1HS-1-5-201/16/2018 5:12:40 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NetAdapterCim provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2736; ProviderPath = %systemroot%\system32\wbem\NetAdapterCim.dll585700004611686018427387904108Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational27362320WIN-5T344G8GM1HS-1-5-191/16/2018 5:12:40 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1260; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll585700004611686018427387904107Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational12601960WIN-5T344G8GM1HS-1-5-201/16/2018 5:12:40 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1260; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll585700004611686018427387904106Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational12601936WIN-5T344G8GM1HS-1-5-201/16/2018 5:12:40 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Namespace = ROOT\CIMV2; NotificationQuery = SELECT * FROM Win32_ProcessStartTrace WHERE ProcessName = 'wsmprovhost.exe'; UserName = ; ClientProcessID = 924, ClientMachine = WIN-5T344G8GM1H; PossibleCause = Temporary586000004611686018427387904105Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9243016WIN-5T344G8GM1HS-1-5-181/16/2018 5:06:17 PMa4626349-8ea8-0003-146c-62a4a88ed301microsoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WMI Kernel Trace Event Provider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 924; ProviderPath = C:\Windows\System32\wbem\krnlprov.dll585700004611686018427387904104Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9243016WIN-5T344G8GM1HS-1-5-181/16/2018 5:06:17 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
MSVDS__PROVIDER provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3428; ProviderPath = %systemroot%\system32\wbem\vdswmi.dll585700004611686018427387904103Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational34285844WIN-5T344G8GM1HS-1-5-201/16/2018 5:06:06 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3428; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll585700004611686018427387904102Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational34285844WIN-5T344G8GM1HS-1-5-201/16/2018 5:06:06 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WMIProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2768; ProviderPath = %systemroot%\system32\wbem\wmiprov.dll585700004611686018427387904101Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational27681104WIN-5T344G8GM1HS-1-5-181/16/2018 5:05:59 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2856; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll585700004611686018427387904100Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational28563704WIN-5T344G8GM1HS-1-5-201/16/2018 5:04:01 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Namespace = //./root/CIMV2; NotificationQuery = select * from MSFT_SCMEventLogEvent; OwnerName = S-1-5-32-544; HostProcessID = 924; Provider= SCM Event Provider, queryID = 0; PossibleCause = Permanent58590000461168601842738790499Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9243356WIN-5T344G8GM1HS-1-5-181/16/2018 5:03:48 PMa4626349-8ea8-0003-c36b-62a4a88ed301microsoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Namespace = //./root/subscription; Eventfilter = SCM Event Log Filter (refer to its activate eventid:5859); Consumer = NTEventLogEventConsumer="SCM Event Log Consumer"; PossibleCause = Binding EventFilter: instance of __EventFilter { CreatorSID = {1, 2, 0, 0, 0, 0, 0, 5, 32, 0, 0, 0, 32, 2, 0, 0}; EventNamespace = "root\\cimv2"; Name = "SCM Event Log Filter"; Query = "select * from MSFT_SCMEventLogEvent"; QueryLanguage = "WQL"; }; Perm. Consumer: instance of NTEventLogEventConsumer { Category = 0; CreatorSID = {1, 2, 0, 0, 0, 0, 0, 5, 32, 0, 0, 0, 32, 2, 0, 0}; EventType = 1; Name = "SCM Event Log Consumer"; NameOfUserSIDProperty = "sid"; SourceName = "Service Control Manager"; }; 58610000461168601842738790498Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9241768WIN-5T344G8GM1HS-1-5-181/16/2018 5:03:48 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
MSVDS__PROVIDER provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2856; ProviderPath = %systemroot%\system32\wbem\vdswmi.dll58570000461168601842738790497Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational28563704WIN-5T344G8GM1HS-1-5-201/16/2018 5:02:51 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
nettcpip provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2856; ProviderPath = %systemroot%\system32\wbem\NetTCPIP.dll58570000461168601842738790496Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational2856812WIN-5T344G8GM1HS-1-5-201/16/2018 5:02:39 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NetAdapterCim provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 5960; ProviderPath = %systemroot%\system32\wbem\NetAdapterCim.dll58570000461168601842738790495Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational59605988WIN-5T344G8GM1HS-1-5-191/16/2018 5:02:39 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2856; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll58570000461168601842738790494Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational28563084WIN-5T344G8GM1HS-1-5-201/16/2018 5:02:39 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 2972; Component = Unknown; Operation = Start IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT ID FROM Win32_ServerFeature; ResultCode = 0x80041032; PossibleCause = Unknown58580200461168601842738790493Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242352WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:13 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{FB2CA36D-0B40-4307-821B-A13B252DE56C}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790492Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242512WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:11 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{F9C77450-3A41-477E-9310-9ACD617BD9E3}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790491Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242512WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:11 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{E62688F0-25FD-4c90-BFF5-F508B9D2E31F}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790490Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242512WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:11 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{E5094040-C46C-4115-B030-04FB2E545B00}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790489Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242512WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:11 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{E4F48E54-F38D-4884-BFB9-D4D2E5729C18}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790488Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242512WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:11 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{E47248BA-94CC-49c4-BBB5-9EB7F05183D0}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790487Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242512WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:11 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{CF7639F3-ABA2-41DB-97F2-81E2C5DBFC5D}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790486Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242512WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:11 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{c6dc5466-785a-11d2-84d0-00c04fb169f7}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790485Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242512WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:11 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{C631DF4C-088F-4156-B058-4375F0853CD8}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790484Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242512WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:11 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{C418DD9D-0D14-4efb-8FBF-CFE535C8FAC7}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790483Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242512WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:11 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{C34B2751-1CF4-44F5-9262-C3FC39666591}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790482Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242512WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:11 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{BC75B1ED-5833-4858-9BB8-CBF0B166DF9D}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790481Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242512WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:11 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{BA649533-0AAC-4E04-B9BC-4DBAE0325B12}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790480Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242512WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:11 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{B087BE9D-ED37-454f-AF9C-04291E351182}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790479Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242512WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:11 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{AADCED64-746C-4633-A97C-D61349046527}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790478Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242512WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:11 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{A3F3E39B-5D83-4940-B954-28315B82F0A8}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790477Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242512WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:11 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{91FBB303-0CD5-4055-BF42-E512A681B325}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790476Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242512WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:11 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{8A28E2C5-8D06-49A4-A08C-632DAA493E17}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790475Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242512WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:11 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{7B849a69-220F-451E-B3FE-2CB811AF94AE}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790474Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242512WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:11 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{7933F41E-56F8-41d6-A31C-4148A711EE93}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790473Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242512WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:11 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{74EE6C03-5363-4554-B161-627540339CAB}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790472Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242512WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:11 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{728EE579-943C-4519-9EF7-AB56765798ED}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790471Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242512WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:11 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{7150F9BF-48AD-4da4-A49C-29EF4A8369BA}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790470Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242512WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:11 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{6232C319-91AC-4931-9385-E70C2B099F0E}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790469Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242512WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:11 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{5794DAFD-BE60-433f-88A2-1A31939AC01F}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790468Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242512WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:11 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{4D2F9B6F-1E52-4711-A382-6A8B1A003DE6}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790467Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242512WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:11 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{4CFB60C1-FAA6-47f1-89AA-0B18730C9FD3}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790466Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242512WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:11 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{4B7C3B0F-E993-4E06-A241-3FBE06943684}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790465Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242512WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:11 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{42B5FAAE-6536-11d2-AE5A-0000F87571E3}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790464Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242512WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:11 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{3A0DBA37-F8B2-4356-83DE-3E90BD5C261F}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790463Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242512WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:11 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{2BFCC077-22D2-48DE-BDE1-2F618D9B476D}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790462Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242512WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:11 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{25537BA6-77A8-11D2-9B6C-0000F8080861}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790461Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242512WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:11 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{1A6364EB-776B-4120-ADE1-B63A406A76B5}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790460Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242512WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:11 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{17D89FEC-5C44-4972-B12D-241CAEF74509}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790459Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242512WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:11 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{169EBF44-942F-4C43-87CE-13C93996EBBE}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790458Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242512WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:11 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{0E28E245-9368-4853-AD84-6DA3BA35BB75}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790457Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242512WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:11 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WMIProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2768; ProviderPath = %systemroot%\system32\wbem\wmiprov.dll58570000461168601842738790456Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational27681124WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:11 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WMIProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2768; ProviderPath = %systemroot%\system32\wbem\wmiprov.dll58570000461168601842738790455Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational27681124WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:11 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{FC491EF1-C4AA-4CE1-B329-414B101DB823}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790454Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242528WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:09 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{fbf687e6-f063-4d9f-9f4f-fd9a26acdd5f}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790453Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242528WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:09 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{FB2CA36D-0B40-4307-821B-A13B252DE56C}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790452Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242528WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:09 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{f3ccc681-b74c-4060-9f26-cd84525dca2a}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790451Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242528WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:09 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{F312195E-3D9D-447A-A3F5-08DFFA24735E}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790450Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242528WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:09 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{E62688F0-25FD-4c90-BFF5-F508B9D2E31F}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790449Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242528WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:09 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{E5094040-C46C-4115-B030-04FB2E545B00}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790448Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242528WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:09 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{E4F48E54-F38D-4884-BFB9-D4D2E5729C18}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790447Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242528WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:09 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{e437bc1c-aa7d-11d2-a382-00c04f991e27}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790446Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242528WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:09 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{CF7639F3-ABA2-41DB-97F2-81E2C5DBFC5D}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790445Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242528WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:09 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{cdeafc3d-948d-49dd-ab12-e578ba4af7aa}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790444Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242528WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:09 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{c6dc5466-785a-11d2-84d0-00c04fb169f7}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790443Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242528WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:09 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{C631DF4C-088F-4156-B058-4375F0853CD8}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790442Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242528WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:09 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{C418DD9D-0D14-4efb-8FBF-CFE535C8FAC7}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790441Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242528WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:09 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{C34B2751-1CF4-44F5-9262-C3FC39666591}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790440Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242528WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:09 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{BC75B1ED-5833-4858-9BB8-CBF0B166DF9D}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790439Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242528WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:09 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{BA649533-0AAC-4E04-B9BC-4DBAE0325B12}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790438Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242528WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:09 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{B587E2B1-4D59-4e7e-AED9-22B9DF11D053}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790437Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242528WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:09 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{B087BE9D-ED37-454f-AF9C-04291E351182}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790436Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242528WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:09 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{AADCED64-746C-4633-A97C-D61349046527}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790435Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242528WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:09 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{A3F3E39B-5D83-4940-B954-28315B82F0A8}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790434Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242528WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:09 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{91FBB303-0CD5-4055-BF42-E512A681B325}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790433Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242528WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:09 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{8A28E2C5-8D06-49A4-A08C-632DAA493E17}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790432Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242528WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:09 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{827D319E-6EAC-11D2-A4EA-00C04F79F83A}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790431Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242528WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:09 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{7B849a69-220F-451E-B3FE-2CB811AF94AE}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790430Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242528WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:09 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{7933F41E-56F8-41d6-A31C-4148A711EE93}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790429Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242528WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:09 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{74EE6C03-5363-4554-B161-627540339CAB}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790428Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242528WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:09 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{728EE579-943C-4519-9EF7-AB56765798ED}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790427Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242528WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:09 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{7150F9BF-48AD-4da4-A49C-29EF4A8369BA}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790426Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242528WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:09 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{6A4C88C6-C502-4f74-8F60-2CB23EDC24E2}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790425Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242528WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:09 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{6232C319-91AC-4931-9385-E70C2B099F0E}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790424Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242528WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:09 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{4CFB60C1-FAA6-47f1-89AA-0B18730C9FD3}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790423Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242528WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:09 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{4bcd6cde-777b-48b6-9804-43568e23545d}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790422Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242528WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:09 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{4B7C3B0F-E993-4E06-A241-3FBE06943684}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790421Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242528WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:09 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{42B5FAAE-6536-11d2-AE5A-0000F87571E3}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790420Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242528WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:09 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{426031c0-0b47-4852-b0ca-ac3d37bfcb39}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790419Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242528WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:09 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{3A0DBA37-F8B2-4356-83DE-3E90BD5C261F}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790418Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242528WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:09 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{3610eda5-77ef-11d2-8dc5-00c04fa31a66}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790417Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242528WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:09 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{2BFCC077-22D2-48DE-BDE1-2F618D9B476D}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790416Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242528WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:09 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{2A8FDC61-2347-4C87-92F6-B05EB91A201A}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790415Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242528WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:09 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{1A6364EB-776B-4120-ADE1-B63A406A76B5}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790414Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242528WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:09 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{17D89FEC-5C44-4972-B12D-241CAEF74509}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790413Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242528WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:09 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{16be69fa-4209-4250-88cb-716cf41954e0}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790412Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242528WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:09 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{169EBF44-942F-4C43-87CE-13C93996EBBE}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790411Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242528WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:09 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{0E28E245-9368-4853-AD84-6DA3BA35BB75}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790410Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242528WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:09 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{0ACDD40C-75AC-47ab-BAA0-BF6DE7E7FE63}"; ResultCode = 0x80041002; PossibleCause = Unknown5858020046116860184273879049Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242528WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:09 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{35378EAC-683F-11D2-A89A-00C04FBBCFA2}"; ResultCode = 0x80041002; PossibleCause = Unknown5858020046116860184273879048Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242528WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:09 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3440; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll5857000046116860184273879047Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational34403468WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:09 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
ServerFeatureProvider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2856; ProviderPath = %windir%\system32\wbem\servercompprov.dll5857000046116860184273879046Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational28563084WIN-5T344G8GM1HS-1-5-201/16/2018 5:02:09 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 2972; Component = Unknown; Operation = Start IWbemServices::ExecQuery - ROOT\CIMV2 : select ChassisTypes from Win32_SystemEnclosure; ResultCode = 0x80041032; PossibleCause = Unknown5858020046116860184273879045Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242484WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:09 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32a provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2856; ProviderPath = %systemroot%\system32\wbem\wmipcima.dll5857000046116860184273879044Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational28563084WIN-5T344G8GM1HS-1-5-201/16/2018 5:02:06 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2856; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll5857000046116860184273879043Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational28562436WIN-5T344G8GM1HS-1-5-201/16/2018 5:02:05 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-PD8DQPRRTAO; User = NT AUTHORITY\SYSTEM; ClientProcessId = 2508; Component = Unknown; Operation = Start IWbemServices::CreateInstanceEnum - root\wmi : MSiSCSI_PortalInfoClass; ResultCode = 0x8004100A; PossibleCause = Unknown5858020046116860184273879042Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9162392WIN-PD8DQPRRTAOS-1-5-181/16/2018 5:01:40 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-PD8DQPRRTAO; User = NT AUTHORITY\SYSTEM; ClientProcessId = 2508; Component = Unknown; Operation = Start IWbemServices::CreateInstanceEnum - root\wmi : MS_SM_AdapterInformationQuery; ResultCode = 0x8004100A; PossibleCause = Unknown5858020046116860184273879041Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9162392WIN-PD8DQPRRTAOS-1-5-181/16/2018 5:01:40 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]